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ABSTRACT 


This  study  analyzes  the  emergent  field  of  eyber  warfare  through 
the  lens  of  eommonly-aeeepted  tenets  of  ethieal  warfare.  By  eomparing 
the  foundational  understanding  of  eoneepts  that  determine  the  justice  of 
wars  {jus  ad  bellum)  and  justice  in  war  {jus  en  bello)  with  the  capabilities 
cyber  warfare  offers,  this  work  highlights  both  causes  for  concern  and 
opportunities  for  betterment.  The  first  chapter  introduces  important 
contextual  information  and  definitions  that  frame  the  arguments  to 
follow.  Chapter  2  presents  a  theoretical  overview  of  ethical  warfare  from 
which  to  build.  This  overview  presents  five  core  tenets:  good  faith, 
proportionality,  non-combatant  immunity,  last  resort,  and  sovereignty. 
Chapter  3  builds  on  this  framework  by  analyzing  how  cyber  warfare 
affects  each  of  the  core  concepts  introduced  above.  The  fourth  chapter 
presents  a  case  study  that  tests  the  theoretical  assertions  presented 
elsewhere  in  the  work.  Finally,  the  conclusion  offers  a  platform  for 
further  exploration  and  surmises  opinions  regarding  ethics  and  cyber 
warfare. 

Cyber  warfare  offers  both  nagging  difficulties  that  complicate 
existing  ethical  warfare  standards  and  exciting  opportunities  to  improve 
how  warfare  is  carried  out.  Decision-makers  charged  with  the  authority 
to  carry  out  acts  of  cyber  warfare  must  understand  the  technical 
limitations  of  the  offensive  and  defensive  components  of  cyber  warfare. 
Even  more  importantly,  these  decision-makers  must  appreciate  how  their 
actions  in  this  burgeoning  domain  help  shape  emergent  norms  and 
standards  that  will  promulgate  through  the  domain. 

Cyber  warfare  has  the  potential  to  facilitate  effects  that  were 
previously  only  achievable  through  lethal  means.  This  is  an  exciting 
development  in  terms  of  ethical  warfare.  While  B.H.  Liddell  Hart 
famously  proposed  the  reason  for  war  is  to  create  a  better  state  of  peace, 
cyber  warfare  offers  the  potential  to  create  a  better  state  of  war. 
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Chapter  1 


Introduction 

Few  are  willing  to  brave  the  disapproval  of  their  fellows,  the  censure  of  the 
colleagues,  the  wrath  of  their  society.  Moral  courage  is  a  rarer  commodity  than 
bravery  in  battle  or  great  intelligence.  Yet  it  is  the  one  essential,  vital  quality  for 
those  who  seek  to  change  a  world  that  yields  most  painfully  to  change. 

-  Robert  F.  Kennedy 

Cyberspace,  the  only  manmade  commons,  offers  tremendous 
opportunities  for  global  commerce,  interpersonal  collaboration,  and 
worldwide  connectivity.  i  Information  in  cyberspace  traverses  enmeshed 
networks  of  devices  and  people  at  light  speed,  sparking  ideas,  coalescing 
thoughts,  and  facilitating  transactions. 2  Cyberspace  and  the 
instantaneous  connections  the  domain  provides  have  redefined  many 
facets  of  human  life,  especially  in  terms  of  space  and  time.  Societal  and 
political  frameworks  are  undergoing  a  transfiguration  wherein  few 
relationships  are  left  untouched  by  the  reach  and  capabilities  of 
electronic  connectivity. ^  In  other  words,  cyberspace  is,  quite  literally, 
changing  the  world. 

This  is  not  the  first  time  technology  has  revolutionized  human 
interaction.  When  modern  ships  first  traversed  the  oceans,  they 
connected  disparate  civilizations  in  ways  that  fundamentally  changed  the 
geopolitical  landscape.  When  airplanes  took  flight  they  made  the  world 
smaller,  allowing  people  to  travel  across  giant  swaths  of  the  earth  at 
unthinkable  speeds.  Air  power  pioneer,  Billy  Mitchell,  said  at  the  dawn 
of  the  air-going  age,  “In  a  trice,  aircraft  have  set  aside  all  ideas  of 


^  Joseph  S.  Nye,  "Power  and  National  Security  in  Cyberspace,"  America's  Cyber  Future:  Security  and 
Prosperity  in  the  Information  Age  2  (n.d.):  1,  accessed  January  21,  2014. 

^  Department  of  Defense  Strategy  for  Operating  in  Cyberspace,  July  2011,  2, 
http://www.defense.gOv/news/d20110714cyber.pdf. 

^  Nicco  Mele,  The  End  of  Big:  How  the  Internet  Makes  David  the  New  Goiiath,  First  edition  (New  York:  St. 
Martin's  Press,  2013),  2. 
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frontiers. ”4  These  paradigm  shifts  ehoked  old  methods  of  global 
eollaboration  until  the  usurped  methods  beeame  obsolete.  Cyberspaee  is 
faeilitating  a  similar  monumental  shift  in  human  interaetion  today. 

Human  relations  involve  both  eollaboration  and  eonfliet.  The 
innovations  that  improve  how  we  partner  with  one  another  oftentimes 
affeet  how  we  wage  war.  In  addition  to  the  benefieial  ehanges  deseribed 
above,  for  example,  transoeeanie  shipping  allowed  the  United  States  to 
send  millions  of  soldiers  abroad  to  fight  two  world  wars.  Airplanes  were 
used  to  deliver  atomie  weapons — a  paradigm  shift  in  their  own  right — to 
kill  millions  of  Japanese  eitizens  in  the  final  throes  of  World  War  11. 
Mitehell,  eommenting  on  air  power  in  war  said,  “A  new  set  of  rules  for  the 
eonduet  of  war  will  have  to  be  devised  and  a  whole  new  set  of  ideas  of 
strategy  learned  by  those  eharged  with  the  eonduet  of  war. ”5  New 
eapabilities  drive  new  definitions  of  aeeeptable  eonduet,  new  thresholds 
between  tolerable  and  intolerable  aets,  and  altogether  new  ethieal  eriteria 
for  deeision-makers  to  eonsider. 

Bold  determinations  on  the  effieaey  of  newly  developed,  untested 
teehnologies  ean  be  elusive  for  even  the  most  seasoned  strategie 
thinkers.  For  example,  eonsider  the  eireumstanees  surrounding  the 
initial  development  and  deployment  of  nuelear  weapons.  In  Danger  and 
Survival,  former  National  Seeurity  Advisor,  MeGeorge  Bundy,  deseribes 
the  environment  of  the  seientists  and  poliey-makers  involved  with 
nuelear  development  efforts  as  one  of  optimism  and  determination. ^  On 
President  Truman’s  deeision  to  drop  two  atomie  bombs  on  Japan,  Bundy 
writes  “As  far  as  we  know  from  the  aeeounts  of  the  three  men  who  met  at 
the  first  major  diseussion  [Truman,  Stimson,  and  Groves],  not  one  of 
them  expressed  any  doubt  that  when  the  bombs  were  ready,  they  should 

William  Mitchell,  Winged  Defense:  The  Development  and  Possibilities  of  Modem  Air  Power— Economic 
and  Military  (Tuscaloosa,  AL:  University  of  Alabama  Press,  2009),  4. 

^  Mitchell,  Winged  Defense,  6. 

®  MeGeorge  Bundy,  Danger  and  Survival:  Choices  about  the  Bomb  in  the  First  Fifty  Years,  1st  ed  (New  York: 
Random  House,  1988),  55. 
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be  used. These  key  leaders  did  not  prediet  that  their  deeision  would 
turn  into  a  fieree  ethieal  debate  persisting  unresolved  to  this  day. 

Dr.  George  Lueas,  a  prominent  Naval  War  College  philosopher  and 
ethieist  at  the  forefront  of  this  subjeet  said,  “When  we  find  ourselves 
venturing  into  a  new  area  of  relatively  unfamiliar  terrain  like  this,  the 
usual  adviee  is  to  proeeed  with  eaution,  speak  and  think  earefully,  and 
observe  as  elosely  as  possible  the  sorts  of  behaviors  that  are  aetually 
taking  plaee,  and  are  found  to  test  the  limits  of  minimally  aeeeptable 
eonduet.”8  Cyberspaee  and  the  eapabilities  the  new  domain  provides  are 
still  in  their  infaney.  Now  is  the  time  to  eonsider  how  using  the  domain 
for  war  will  shape  norms  of  behavior  around  the  world.  While  skirmishes 
and  low-level  eonfliet  eontinue  to  permeate  eyberspaee,  the  world  has  yet 
to  witness  a  full-seale  eyber  eonfliet  that  approaehes  the  seale  some 
experts  prediet. ^  By  framing  the  ethieal  debate  and  addressing  the 
disparity  between  what  we  can  do  and  what  we  should  do,  the  eolleetive 
global  soeiety  has  the  rare  opportunity  to  eontemplate  ethieal  guidelines 
for  eyber  warfare  before  history  is  replete  with  examples  of  unethieal 
employment.  The  main  goal  of  this  paper  is  to  inform  this  emerging 
ethieal  debate. 

Definitions 

The  voeabulary  used  to  deseribe  eonfliets  and  eollaboration  in  this 
new  domain  is  not  yet  understood  universally.  Therefore,  before  moving 
forward,  key  terms  used  throughout  this  study  deserve  speeifie  attention. 
As  transformative  as  the  eyberspaee  domain  is,  for  example,  the  eoneept 


Bundy,  Danger  and  Survival,  59. 

^  Dr.  George  R.  Lucas,  Jr.  on  Just  War  and  Cyber  Conflict  Part  2,  2012, 
http://www. youtube. com/watch?v=FRdsUwSuYis&feature=youtube_gdata_player. 

^  Elisabeth  Bumiller  and  Thom  Shanker,  "Panetta  Warns  of  Dire  Threat  of  Cyberattack  on  US,"  New  York 
Times  11  (2012), 

http://moodle2.  portage.  kl2.wi.us/pluginfile.php/21229/mod_resource/content/l/Digital%20Pearl%20Ha 
rbor.pdf.  In  a  speech  at  the  Intrepid  Sea,  Air  and  Space  Museum  in  New  York,  Mr.  Panetta  painted  a 
dire  picture  of  how  a  cyber-attack  on  the  United  States  might  unfold.  He  said  he  was 
reacting  to  increasing  aggressiveness  and  technological  advances  by  the  nation's 
adversaries. 
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of  the  domain  itself  is  only  vaguely  defined  and  even  less  understood. 
Cyberspaee  is  not  a  plaee.  It  has  no  physieal  address  beyond  the 
routers,  servers,  eables,  and  eomputers  that  form  its  framework.  Yet 
eyberspaee  exists  everywhere  in  the  eonneetions  it  faeilitates  between 
peoples  and  deviees.io  Cyberspaee  is  eonstantly  refereneed  in 
diseussions  of  polities,  seeurity,  eeonomies,  and  influenee.  None  of  these 
diseiplines  defines  eyberspaee  the  same  way.n  Additionally,  nearly  every 
eommunity  with  a  stake  in  eyberspaee,  from  teehnophiles  to  eleeted 
offieials,  eontextualizes  the  domain  in  a  unique  way.  The  International 
Teleeommunieations  Union,  under  the  auspiees  of  the  United  Nations, 
for  instanee,  held  a  multi-national  assembly  in  Dubai  in  November  2012 
that  foeused  exelusively  on  how  the  international  eommunity  defines  and 
governs  eyberspaee.  The  assembly  failed  to  reaeh  eonsensus,  sending  the 
international  partners  baek  to  their  home  eountries  with  even  less  elarity 
than  they  started  with.  12 

In  2006  the  Chairman  of  the  U.S.  Joint  Chiefs  of  Staff  released  the 
National  Military  Strategy  for  Cyberspaee  Operations.  The  strategy 
defined  eyberspaee  as  "A  domain  eharaeterized  by  the  use  of  eleetronies 
and  the  electromagnetie  spectrum  to  store,  modify,  and  exchange  data 
via  networked  systems  and  associated  physical  infrastructure. ”12  The 
Department  of  Defense  altered  its  definition  of  cyberspace  in  2008, 
calling  it  “a  global  domain  within  the  information  environment  consisting 


Cyberspace  and  National  Security:  Threats,  Opportunities,  and  Power  in  a  Virtual  World  (Washington, 
DC:  Georgetown  University  Press,  2012),  214. 

See,  for  example,  three  sets  of  definitions  that  focus  on  different  ontological  roots  for  the  realm  of 
cyberspace,  from  openness  and  oneness  to  a  partitioned  environment  of  safeguards  facilitated  by 
electronic  controls.  U.S  National  Military  Strategy  for  Cyberspace  Operations,  2006,  6, 
http://www.dod.mil/pubs/foi/joint_staff/jointStaffJointOperations/07-F-2105docl.pdf;  Christopher 
Castellino,  "Defense  Department  Adopts  New  Definition  of  'Cyberspace,'"  Inside  the  Air  Force,  May  23, 
2008,  http://integrator.hanscom.af.mil/2008/May/05292008/05292008-24.htm;  Rain  Ottis  and  Peeter 
Lorents,  "Cyberspace:  Definition  and  Implications,"  Proceedings  of  the  5th  International  Conference  on 
Information  Warfare  and  Security,  2010,  267-70. 

World  Telecommunication  Standardization  Assembly  Resolution  50  -  Cybersecurity,  Resplution 
(International  Telecommunications  Union,  n.d.),  1,  http://www.itu.int/en/ITU- 
T/wtsal2/Documents/resolutions/Resolution%2050.pdf. 

U.S  National  Military  Strategy  for  Cyberspace  Operations,  6. 
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of  the  interdependent  network  of  information  teehnology  infrastruetures, 
ineluding  the  Internet,  teleeommunieations  network,  eomputer  systems, 
and  embedded  proeessors  and  eontrollers.”i‘^  While  the  new  definition 
still  elings  to  the  teehnieal  roots  of  eomputer  seienee  and  networking,  it 
notably  infers  a  more  eognitive  basis  of  eyberspaee  in  the  information 
realm.  Cyberspaee  is  more  than  a  eolleetion  of  intereonneeted  eleetronie 
deviees  and  proeessors.  The  networks  and  peripherals  that  eonneet 
people  together  in  eyberspaee  form  the  medium,  but  eyberspaee  more 
elosely  resembles  a  eomplex  nervous  system  than  a  sterile  eleetronie 
array.  As  eyberspaee  eontinues  to  root  itself,  its  reaeh  and  entanglement 
in  the  more  traditional  domains  make  it  a  powerful  influenee  on  existing 
soeietal  struetures.  Cyberspaee  is  not  just  a  quantitatively  different 
environment  that  builds  upon  traditional  understanding.  Cyberspaee  is  a 
qualitatively  different  realm  that  does  not  lend  itself  to  strategie 
paradigms  from  other  operating  environments. 

The  nature  of  eyberspaee  eontinues  to  evolve  away  from  its 
teehnieal  underpinnings  toward  its  eultural  implieations.  In  2011 
President  Barraek  Obama  released  the  International  Strategy  for 
Cyberspaee.  The  White  House’s  interpretation  of  the  eyber  realm  further 
pushes  eontemporary  thinking  on  eyberspaee  away  from  its  eomputer- 
networking  roots  into  a  more  humanistie,  interpersonal  eontext.  The 
report  states  “The  eyberspaee  environment  that  we  seek  rewards 
innovation  and  empowers  individuals;  it  eonneets  individuals  and 
strengthens  eommunities;  it  builds  better  governments  and  expands 
aeeountability;  it  safeguards  fundamental  freedoms  and  enhanees 
personal  privaey;  it  builds  understanding,  elarifies  norms  of  behavior, 
and  enhanees  national  and  international  seeurity.i^”  In  this  eontext, 
eyberspaee  beeomes  an  independent  arena  for  thought  and  aetion  that  is 

Christopher  Castellino,  "Defense  Department  Adopts  New  Definition  of  'Cyberspace.'" 

United  States  White  House  Office  and  Barack  Obama,  International  Strategy  for  Cyberspace:  Prosperity, 
Security,  and  Openness  in  a  Networked  Worldr  (White  House,  2011),  8-9, 
http://scholar. google. com/scholar?cluster=13455456761010981645&hl=en&oi=scholarr. 
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altogether  distinet  from  its  physieal  eounterparts  on  land,  at  sea,  in  the 
air,  and  in  spaee. 

While  it  is  noble  to  seek  a  eyberspaee  environment  that  promotes 
eooperation  and  innovation,  we  must  aeknowledge  the  dark, 
transgressive  side  of  this  burgeoning  domain.  The  antithesis  of  the 
mutually  benefieial  environment  we  seek  is  a  eyberspaee  where 
eompetition  and  fear  overshadow  eollaboration.  Hobbes,  in  his 
fundamental  law  of  nature,  warns,  “That  every  man,  ought  to  endeavour 
Peaee,  as  farre  as  he  has  hope  of  obtaining  it;  and  when  he  eannot  obtain 
it,  that  he  may  seek,  and  use,  all  helps  and  advantages  of  Warre.”i6 
eyberspaee  will  eontinue  to  eivilize.  As  the  domain  matures,  however,  so 
too  will  the  methods  of  malefaetors  who  upset  eolleetive  attempts  at 
peaee  in  favor  of  eonfliet. 

Cyber  warfare  is  an  oft-debated  term  that  is  eentral  to  the 
diseussion  that  follows.  Riehard  Clarke,  a  widely  regarded  homeland 
seeurity  and  eyber  seeurity  expert  who  advised  three  US  presidents, 
defines  eyber  warfare  as  “aetions  by  a  nation-state  to  penetrate  another 
nation’s  eomputers  or  networks  for  the  purposes  of  eausing  damage  or 
disruption. ”17  This  definition,  however,  is  overly  restrietive  in  the  way  it 
limits  who  ean  be  eonsidered  eombatants  in  eyberspaee.  Cyberspaee 
empowers  individuals  and  non- state  aetors  in  ways  the  physieal  domains 
eannot.  In  his  2013  book.  The  End  of  Big,  Harvard  leeturer  and  digital 
strategist  Nieeo  Mele  writes  “Today,  national  seeurity  is  fragile,  with 
power  shifting  to  teehnologieally-equipped  terrorist  groups,  revolutionary 
movements,  eriminal  enterprises,  murky  eolleetives  sueh  as  Anonymous, 
and  even  isolated  individuals  with  an  Internet  eonneetion.”!®  This 
newfound  power  ean  be  used  to  promote  peaee,  but  it  is  also  eause  to 

Thomas  Hobbes,  Leviathan,  Rev.  student  ed,  Cambridge  Texts  in  the  History  of  Political  Thought 
(Cambridge  ;  New  York:  Cambridge  University  Press,  1996),  92. 

Richard  A.  Clarke,  Cyber  War:  The  next  Threat  to  National  Security  and  What  to  Do  about  It,  1st  Ecco 
pbk.  ed  (New  York:  Ecco,  2012),  6. 

Mele,  The  End  of  Big,  155. 
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rethink  the  boundaries  we  plaee  around  the  eoneept  of  warfare  in 
eyberspaee.  By  limiting  partieipants  to  only  those  of  reeognized  nation¬ 
states  we  inappropriately  eonstrain  the  field  of  eyber  warfare. 

Jeffrey  Carr,  author  of  Inside  Cyber  Warfare,  summons  the  spirit  of 
Sun  Tzu  in  his  definition  of  eyber  warfare,  saying  it  is  “the  art  and 
seienee  of  fighting  without  fighting;  of  defeating  an  opponent  without 
spilling  their  blood. While  this  interpretation  eertainly  broadens  the 
definition  suffieiently  to  eneompass  aetions  by  both  state  and  non-state 
aetors,  it  unneeessarily  opens  the  aperture  for  what  should  be 
eonsidered  aets  of  eyber  warfare.  If  the  target  of  eyber  aggression  is  a 
eommereial  enterprise,  for  instanee,  a  more  appropriate  label  for  the 
aetion  might  be  eyber-erime.  Cyber  warfare  aims  to  influenee  poliey  and 
power.  The  interpretations  presented  above,  eombined  with  Carl  von 
Clausewitz’s  assertion  that  war  is  a  eontinuation  of  poliey,  yields  the 
definition  of  eyber  warfare  used  through  the  rest  of  this  paper:  Aetions  by 
state  or  non- state  aetors  that  exploit  an  adversary’s  information  systems 
in  order  to  further  politieal  objeetives. 

If  eyber  warfare  is  a  unique  form  of  warfare,  it  deserves  elose 
examination  uneneumbered  by  traditional  doetrine,  rules,  and  laws. 
Cyber  warfare  enhanees  land,  sea,  air,  and  spaee  power  but  it  also  offers 
altogether  new  eapabilities.  Consider  the  following  example  highlighting 
how  eyber  eapabilities  ehanged  the  faee  of  air  power  in  less  than  two 
deeades.  When  the  United  States  repelled  Iraq’s  invasion  of  Kuwait  in 
1991,  the  Ameriean  Air  Foree  disabled  Iraq’s  integrated  air  defense 
system  by  permanently  destroying  radar  sites,  anti-aireraft  systems,  and 
eleetrieal  switehing  stations. 2°  In  2007,  the  Israeli  Air  Foree  penetrated 
Syrian  airspaee  en  route  to  an  alleged  nuelear  reaetor  at  Dier-ez-Zor. 
Israeli  pilots  simply  flew  past  Syria’s  air  defense  systems  undeteeted. 

Jeffrey  Carr,  Inside  Cyber  Warfare,  2nd  ed  (Beijing  ;  Sebastopol,  CA:  O'Reilly,  2012),  2. 

Michael  R  Gordon  and  Trainor,  The  Generals'  War:  The  inside  Story  of  the  Conflict  in  the  Gulf  (Boston: 
Little,  Brown,  1995),  112. 
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While  Israeli  offieials  have  never  eonfirmed  the  details  of  this  operation,  it 
is  widely  aeeepted  that  a  eyber-attaek  blinded  the  air  defense  systems, 
aehieving  the  desired  effeet,  while  preserving  the  systems  and  their 
assoeiated  personnel  from  physieal  destruetion.21  Signifieant  questions 
regarding  the  eharaeter  and  nature  of  war  emerge  when  targets  ean  be 
turned  off  and  on  rather  than  being  destroyed. 

Finally,  it  is  worthwhile  to  draw  distinetion  between  the  terms 
ethics  and  morality  as  they  appear  in  the  aeademie  resourees  that  form 
the  basis  of  the  argument  that  follows.  Morality,  generally  defined  as 
that  whieh  governs  right  and  wrong,  is  a  term  that  seldom  appears  in 
isolation  without  some  form  of  eaveat  or  delineator. 22  Christian  morality, 
for  instanee,  defines  moral  prineiples  within  the  parameters  established 
by  the  Bible. ^3  Politieal  seientists  grapple  with  terms  like  realist  morality 
when  exploring  international  norms  and  standards. The  Stanford 
Eneyelopedia  of  Philosophy  reeognizes  this  tendeney  and  suggests 
morality  ean  be  both  a  term  that  deseribes  attributes  of  a  partieular 
group  or  soeiety,  or  it  ean  be  a  normative  term  that  applies  to  all  rational 
humans. Miehael  Walzer  grounds  this  eoneept  in  terms  applieable  to 
this  study  when  he  asserts,  “It  is  important  to  stress  that  the  moral 
reality  of  war  is  not  fixed  by  the  aetual  aetivities  of  soldiers  but  by  the 
opinions  of  mankind. This  work  infers  morality  to  be  a  guiding 
philosophieal  eoneept  that  differentiates  between  right  and  wrong  at  a 
foundational  level.  This  study  aeknowledges  the  logie  behind  Hobbes’ 
sentiment,  however,  when  he  writes  “For  one  man  ealleth  Wisdome,  what 

Charles  W.  Douglass,  21st  Century  Cyber  Security:  Legal  Authorities  and  Requirements,  Strategic 
Research  Project  (U.S.  Army  War  College,  March  22,  2012),  14. 

Oxford  English  Dictionary,  Oxford  English  Dictionary  Online  (Oxford  University  Press,  Oxford,  UK 
http://www.  oed.  com,  2008), 

http://scholar.google.com/scholar?cluster=5447292547848391191&hl=en&oi=scholarr. 

Peace,  Politics,  and  the  People  of  God  (Philadelphia:  Fortress  Press,  1986),  117. 

Justin  Cruickshank,  Critical  Realism:  The  Difference  It  Makes  (Routledge,  2003),  31. 

Bernard  Gert,  "The  Definition  of  Morality,"  in  The  Stanford  Encyclopedia  of  Philosophy,  ed.  Edward  N. 
Zalta,  Fall  2012,  2012,  http://plato.stanford.edu/archives/fall2012/entries/morality-definition/. 

Michael  Walzer,  Just  and  Unjust  Wars:  A  Moral  Argument  with  Historical  Illustrations,  4th  ed  (New  York: 
Basic  Books,  2006),  15. 
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another  calleth  feare;  and  one  cruelty,  what  another  justice;  one 
prodigality,  what  another  magnanimity. . .  Moral  eonsiderations  and 
interpretations,  therefore,  may  differ  aeross  soeieties  or  eommunities 
depending  on  how  right  and  wrong  are  pereeived. 

Ethies,  on  the  other  hand,  is  by  and  large  eonsidered  to  be  a 
braneh  of  knowledge  that  deals  with  moral  prineiples.^s  Ethies,  in  this 
interpretation,  is  the  study  of  morality  along  with  its  eireumstanees, 
eontext,  and  aggregative  features.  Aeademie  and  professional 
eommunities  routinely  adopt  ethieal  standards.  Medieal  ethies,  for 
example,  govern  the  professional  and  moral  standards  of  medieal 
praetitioners.29  This  paper  adopts  an  interpretation  of  ethies  that 
emphasizes  the  professional  nuanee  related  to  the  term.  While  the 
arguments  presented  throughout  this  work  deal  with  both  morality  and 
the  ethieal  struetures  that  frame  and  interpret  morals,  the  voeabulary 
used  herein  is  ehosen  earefully.  This  work  will  foeus  on  the  ethies  of 
warfare  and  the  ethies  of  eyber  warfare  as  eolleetions  of  moral  prineiples 
interpreted  through  the  lens  of  the  profession  of  arms. 

Limitations 

The  faet  that  a  full-seale  employment  of  eyber  warfare  remains  only 
a  theoretieal  possibility  is  a  good  thing.  Cyber  warfare  is  eapable  of 
eausing  grave  harm  to  the  world’s  eitizenry  and  its  nation  states. 3° 
However,  the  absenee  of  historieal  evidenee  and  preeedents  ereates 
diffieulties  for  aeademies  and  praetitioners  studying  the  implieations  of 
this  field.  One  ean  easily  look  to  history  to  determine  how  maehine 


Hobbes,  Leviathan,  31. 

Dictionary,  Oxford  English  Dictionary  Online.  One  definition  of  ethics  presented  in  the  Oxford 
Dictionary  makes  the  term  nearly  synonymous  with  morality  while  a  second  definition  creates  the 
understanding  that  ethics  contains  the  study  of  morality  in  a  given  context. 

American  Medical  Association,  Principles  of  Medical  Ethics  of  the  American  Medical  Association 
(American  Medical  Association  Press,  1903),  Preface. 

Clarke,  Cyber  War,  2012, 104.  Clarke  describes  how  the  capabilities  known  to  exist  in  the  US  arsenal  of 
cyber  weapons  would  impact  the  United  States  if  its  adversaries  had  similar  weaponry  and  access. 
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guns,  nuclear  weapons,  and  poisonous  gasses  ehanged  pereeptions  of 
war  beeause  all  three  were  used  in  eombat.  The  reaetions  to  eaeh  and 
the  ensuing  ethieal  debates  helped  eonstruet  the  ethieal  norms  we 
employ  today.  Without  this  historieal  guidanee,  the  ethieal  eonstruet  for 
eyber  warfare  will  remain,  at  best,  notional.  For  the  sake  of  humanity, 
let  us  all  hope  it  remains  as  sueh. 

The  eoneepts  of  anonymity  and  attribution  together  form  another 
limitation  this  study  must  endure.  It  is  easy  for  aetors  in  eyberspaee 
today  to  remain  anonymous  if  they  ehose  to  do  so.  Eneryption 
teehnologies  allow  even  unsophistieated  aetors  in  eyberspaee  to  do  a 
relatively  good  job  of  eovering  their  traeks.^i  Nation-states  and  well- 
resoureed  non-state  aetors  have  even  more  advaneed  eapabilities  that 
allow  them  to  remain  anonymous  online.  These  faetors,  eoupled  with  the 
monetary  and  eomputing  resourees  required  to  reeord  the  aetions  of 
individual  people  in  eyberspaee  make  attribution  ineredibly  diffieult. 
Therefore,  even  aetors  who  make  little  effort  to  be  anonymous  are  likely 
to  remain  undeteeted  an3rway. 

These  attribution  and  anonymity  problems  ereate  limitations  to 
this  study  beeause  they  deerease  the  available  evidenee  assoeiated  with 
the  low-seale  aets  of  eyber  war  that  have  taken  plaee.  Anonymity,  and 
the  effeet  it  has  on  the  ethies  of  eyber  warfare,  will  be  diseussed  later. 

The  important  point  here  is  that  anonymity  also  limits  the  depth  of 
evidenee  available  for  aeademie  researeh. 

Methodology  and  Evidence 

The  ethies  of  warfare  have  been  studied  and  doeumented  almost 
eontinuously  sinee  Thueydides  wrote  about  the  Peloponnesian  War  in 


Dan  Goodin,  "Scientists  Detect  'spoiled  Onions'  Trying  to  Sabotage  Tor  Privacy  Network,"  Ars  Technica, 
January  21,  2014,  http://arstechnica.eom/security/2014/01/scientists-detect-spoiled-onions-trying-to- 
sabotage-tor-privacy-network/.  Tor  is  a  widely  available  software  client  that  allows  anyone  with  a 
computer  to  traverse  cyberspace  anonymously  using  commercial-class  encryption. 
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431  BC32  Academic  research  on  the  ethics  of  cyber  warfare,  however,  is 
only  now  starting  to  reach  publication.  This  paper  will  build  on  the 
mature  tenets  of  the  existing  just-war  ethic  where  logically  sound 
comparisons  can  be  made.  Commonly  accepted  attributes  of  just-war 
theory  such  as  non-combatant  immunity  and  proportionality  form  a 
strong  foundation  from  which  to  build  arguments  relevant  to  the  ethics 
of  cyber  warfare.  The  next  chapter  will  establish  a  framework  of  ethics 
and  war.  The  concepts  presented  in  Chapter  Two  are  drawn  from  sound 
military,  political,  and  philosophical  sources  that  collectively  form  the 
just-war  ethic  as  we  know  it  today. 

One  should  caution  against  the  temptation  to  transpose  ethical 
standards  directly  from  traditional  forms  of  warfare  to  cyber  warfare 
without  closely  examining  the  specific  criteria  used  to  justify  each 
application.  Cyber  warfare  is  unique.  The  ethical  norms  of  traditional 
warfare  serve  as  sound  points  of  departure  but  they  are  not  sufficient. 
Chapter  Three  will  build  upon  our  basic  ethical  war  framework,  aligning 
with  accepted  standards  where  appropriate  and  departing  from  these 
ideas  where  required.  Current  events  drawn  from  a  host  of  professional 
journals  and  media  outlets,  combined  with  a  fledgling  collection  of  theory 
on  cyber  warfare,  will  form  the  evidentiary  base  for  ethical  proposals 
specific  to  cyber  warfare. 

Finally,  Chapter  Four  will  explore  how  the  concepts  developed  in 
the  third  chapter  apply  to  a  hypothetical  cyber  warfare  case  study.  With 
only  limited  historical  evidence,  direct  application  of  this  theory  is 
difficult.  Current  understanding  of  the  capabilities  and  limitations  of 
cyber  warfare  paint  a  reasonably  clear  picture  of  what  cyber  warfare 
might  entail.  This  scenario  will  serve  as  a  proving  ground  for  ethical 
concepts  developed  throughout  the  rest  of  this  work. 

Thucydides,  History  of  the  Peloponnesian  War,  [Rev.  ed,  The  Penguin  Classics  (Harmondsworth,  Eng., 
Baltimore]:  Penguin  Books,  1972).  Thucydides  offers  several  examples  of  might  versus  right  through  the 
course  of  the  war,  including  The  Mytilenian  Debate  and  the  Melian  Dialogue. 
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Cyberspace  is  pervasive.  As  the  global  society  becomes 
increasingly  dependent  upon  the  advances  cyberspace  offers,  ethical 
standards  and  norms  become  even  more  vital.  This  work  intends  to 
inform  the  emerging  ethical  debate  in  hopes  of  encouraging  standards  for 
the  betterment  of  a  globally  interconnected  society. 
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Chapter  2 

An  Ethical  Framework  of  War 


On  the  surface  it  seems  counterintuitive  to  study  ethics  and 
warfare  in  the  same  space  -  the  same  cosmos  of  thought.  Maybe  two 
ideas  that  appear  diametrically  opposed  ought  to  be  kept  that  way. 
Ethics,  that  which  pertains  to  the  ideals  of  right  and  wrong,  seems  to 
have  very  little  overlap  with  a  nasty,  brutish  thing  like  war.  While  one 
party  lobbies  for  cooperative  peace,  the  other  sharpens  its  daggers. 
However,  these  two  spheres  overlap  in  surprising  and  unexpected  ways. 
Take  for  instance  war  that  is  intended  to  return  conquered  people  to 
freedom.  Consider  war  that  is  fought  for  purely  defensive  reasons. 

People  fighting  for  their  own  survival  seem  quite  justified  in  taking  up 
arms  to  do  so. 

James  Childress  uses  the  example  of  early  Christians  to  illustrate 
the  logjam  between  pacifism  and  war.^  Childress  cites  Christian 
teachings,  especially  the  Sermon  on  the  Mount,  as  ethically  binding 
requirements  for  Christians  to  oppose  the  ghastly  practices  of  bloodshed 
in  war.  He  carries  the  debate  forward,  however,  by  reframing  the 
simplistic  description  of  pacifism  from  “opposition  to  war”  into  a  more 
provocative  definition  of  the  term:  “making  peace. In  doing  so, 

Childress  opens  the  door  to  the  possibility  that  war  may  be  required  in 
order  to  create  peace.  Military  theorists  in  the  vein  of  B.H.  Liddell  Hart 
echo  similar  sentiments.  Liddell  Hart  says  “The  object  in  war  is  a  better 
state  of  peace.... Hence  it  is  essential  to  conduct  war  with  constant  regard 
to  the  peace  you  desire.”^ 


^  James  Childress  is  the  John  Allen  Hollingsworth  Professor  of  Ethics  at  the  University  of  Virginia  Institute 
for  Practical  Ethics  and  Public  Life.  In  2004,  Childress  received  the  Lifetime  Achievement  Award  from  the 
American  Society  of  Bioethics  and  Humanities. 

^  Peace,  Politics,  and  the  People  of  God  (Philadelphia:  Fortress  Press,  1986),  118. 

^  Basil  Henry  Liddell  Hart,  Strategy,  2nd  rev.  ed  (New  York,  N.Y.,  U.S.A:  Meridian,  1991),  338. 
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If  the  duty  of  pacifism  is  to  create  peace,  the  pacifist  finds  himself 
in  a  dilemma  that  requires  close  examination  of  the  type  of  peace 
desired.  Peace  on  someone  else’s  terms  requires  only  acquiescence,  but 
self-determined  peace  must  be  protected  from  evil  forces  that  threaten  it. 
William  Frankena  extrapolates  Childress’s  position  on  peace  by  relating 
it  to  “beneficence,”  or  active  goodness. ^  Frankena  suggests  man  is 
obligated  to  create  peace  for  his  fellow  man  through  four  levels  of 
beneficence:  (1)  by  not  inflicting  evil,  (2)  hy  preventing  evil,  (3)  by  removing 
evil,  and  (4)  by  promoting  good.^  Frankena’s  interpretation  suggests 
peace  is  an  active  state  that  requires  maintenance.  Peace,  in  the  face  of 
evil,  may  require  the  use  of  force. 

In  the  face  of  an  unrelenting  enemy,  war  surfaces  as  the  ethical 
alternative  to  forfeiture  of  life  and  values.  Childress  calls  responsibilities 
that  harbor  strong  moral  reasons  for  their  performance  prima-facie 
obligations.^  For  example,  the  idea  that  a  man  should  not  kill  or  injure 
another  man  is  a  prima-facie  concern.  When  this  prima-facie  obligation 
conflicts  with  the  moral  requirement  to  protect  people  from  evil, 
reasoning  and  justification  are  required."^  Childress  writes,  “But  if  one 
does  not  misconstrue  peace  as  the  total  absence  of  conflict,  one  can  see 
how  the  prima-facie  obligation  not  to  injure  or  kill  others  persists  even  in 
the  midst  of  war  by  mandating  the  ultimate  objective  of  peace.  And 
through  the  object  of  peace... it  imposes  other  restraints  on  the  conduct 
of  war.”®  If  one  can  agree  that  evil  exists,  one  must  also  consider  man’s 
responsibility  to  counter  evil.  Frankena  outlines  ethical  responsibilities 

William  K.  Frankena  was  an  American  moral  philosopher.  He  was  a  member  of  the  University  of 
Michigan's  department  of  philosophy  for  41  years,  and  chair  of  the  department  for  14  years.  Frankena 
published  several  books  on  ethics  and  morality  including  Ethics  (1988)  and  Perspectives  on  Morality: 
Essays  (1977). 

^  William  K.  Frankena,  Ethics,  2d  ed,  Prentice-Hall  Foundations  of  Philosophy  Series  (Englewood  Cliffs,  N.J: 
Prentice-Hall,  1973),  47. 

®  James  Childress,  "Just-War  Theories:  The  Bases,  Interrelations,  Priorities  and  Functions  for  Their 
Criteria,"  Theological  Studies  39,  no.  3  (1978):  430. 

Childress,  "Just-War  Theories:  The  Bases,  Interrelations,  Priorities  and  Functions  for  Their  Criteria,"  432. 
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in  his  beneficence  levels  2,  3,  and  4  that  require  steadfast  resistance  and 
measured  force.  While  some  methods  of  force  may  be  interpreted  as  evil 
in  and  of  themselves,  others  are  vindicated  when  all  feasible  alternatives 
fail.  Man  has  a  requirement  to  create  and  protect  peace  and  this 
sometimes  requires  war. 

Realists  counter  this  argument  by  questioning  the  motivations  of 
the  actors  involved.  Waltz,  for  example,  argues  that  man  only  cooperates 
with  fellow  men  in  so  far  as  “life  takes  priority  over  justice.”^  Hobbes 
certainly  paints  a  bleak  picture  of  societal  cooperation  when  he  insists 
life,  in  the  absence  of  agreed  tepid  collaboration,  is  bound  to  be  “solitary, 
poore  [sic],  nasty,  brutish,  and  short. J.F.C.  Fuller,  a  lifelong  military 
theorist  and  practitioner,  wrote  “We  frequently  hear  the  assertion  made 
that  man  has  a  right  to  live.  In  spite  of  the  humanitarians,  natural  man, 
1  hold,  has  no  right  to  live,  but,  possessing  power  to  protect  his  life,  his 
might  becomes  the  right  to  safeguard  it.’’^^  Contrary  to  Childress’s 
interpretation,  realists  suggest  man’s  self-interest  drives  him  toward  a 
cooperative  state,  regardless  of  his  desire  for  greater  peace.  While 
Childress  might  interpret  the  cause  of  a  war  as  a  desire  for  better  society. 
Waltz  and  other  realists  could  interpret  the  same  conflict  as  one  fought 
to  ensure  survival,  regardless  of  any  ethical  predisposition. 

Yet  as  long  as  historians  and  philosophers  have  been  writing  and 
thinking  about  war,  they  have  also  been  considering  whether  its  practice 
and  methods  are  right  and  just.  Michael  Walzer,  discussing  what  he 
calls  “Historical  Relativism,”  summarizes  this  concept  brilliantly,  saying 
“Even  when  world  views  and  high  ideals  have  been  abandoned — as  the 
glorification  of  aristocratic  chivalry  was  abandoned  in  early  moderns 
times — notions  about  right  and  wrong  conduct  are  remarkably 


^  Kenneth  N.  Waltz,  Man,  the  State,  and  War:  A  Theoretical  Analysis  (New  York:  Columbia  University 
Press,  2001),  172. 
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persistent:  the  military  eode  survives  the  death  of  warrior  idealism. If 
the  pure  realists  and  Hobbesians  are  eorreet  in  their  interpretation  that 
war  simply  falls  outside  the  moral  universe  of  right  and  wrong,  the 
debate  ends  here.  However,  if  Thueydides’s  agony  over  the  Athenians’ 
deeision  to  attaek  Melos  in  430  B.C  was  justified  we  have  eause  to 
ponder  this  topie.^^  If  Clausewitz’s  eareful  eoupling  of  violenee  and 
poliey  hundreds  of  years  later  offers  any  indieation,  military  aets,  by 
nature,  inelude  ethieal  eomponents.^"^  Miehael  Walzer  warns,  “War is 
hell.”i^  Yet  if  situations  exist  where  war  beeomes  the  only  viable  option 
for  otherwise  peaeeful  people,  we  must  eonsider  the  ethies  of  war,  or  jus 
ad  bellumJ^ 

Therefore,  the  erevasse  between  war  and  ethies  is  mueh  smaller 
than  it  appears  at  first  pass.  Unless  we  assume  righteousness  will 
naturally  prevail  over  evil  without  man’s  intervention,  wars  may  beeome 
neeessary.  Furthermore,  the  justifieation  for  eertain  wars  ean  be 
founded  on  eompletely  ethieal  terms.  The  work  of  the  strategist,  poliey- 
maker,  and  average  eitizen  is  in  not  to  determine  whether  war  is  just,  but 
to  surmise  which  wars  are  just  and  unjust.  Considering  ethieal 
differenees  brought  about  by  motivations,  eultures,  religions,  and 
eapabilities,  the  task  of  differentiating  between  just  war  and  unethieal 
violenee  is  a  diffieult  task  indeed. 

Ethieal  judgment  does  not  end  when  one  determines  a  war  is 
justified.  The  methods  used  in  war,  jus  en  hello,  are  also  subjeet  to  fieree 
debate.  Perhaps  even  more  important  than  whether  wars  are  fought  is 

Michael  Walzer,  Just  and  Unjust  Wars:  A  Moral  Argument  with  Historical  Illustrations,  4th  ed  (New  York: 
Basic  Books,  2006),  16. 

Thucydides,  History  of  the  Peloponnesian  War,  1972,  403-405.  The  Melian  dialog  carefully  captures  the 
debate  between  Melos  and  Athens  over  whether  an  attack  against  Melos  was  justified  given  the  inability 
of  Melos  to  resist. 

Carl  Von  Clausewitz,  Michael  Howard,  and  Peter  Paret,  On  War  (Princeton:  Princeton  University  Press, 
2011),  89,  http://site.ebrary.com/id/10578581.  Clausewitz  is  careful  to  delineate  acts  of  war  from 
primordial  violence  in  his  "three  tendencies"  that  underpin  war. 

Walzer,  Just  and  Unjust  Wars,  21. 

Walzer,  Just  and  Unjust  Wars,  21. 
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the  question  of  how  they  are  fought.  The  first  reeorded  restraints  plaeed 
on  the  use  of  foree  that  limited  raw  military  eapabilities  stemmed  from 
Gratian’s  eompilation  of  eanon  law.^'^  One  of  the  early  eanonieal 
prineiples,  the  Truee  of  God,  originally  prohibited  Christians  from 
fighting  on  Sundays.  By  the  1  century,  the  ban  as  it  was  written 
extended  to  include  most  Christian  festivals.  While  history  is  replete 
with  instances  where  the  ban  was  ignored  or  reinterpreted  to  allow 
certain  types  of  warfare  to  occur  on  holy  days,  the  existence  of  ethical 
limitations  within  the  conduct  of  war  is  significant. 

Jus  en  hello  also  incorporates  the  idea  that  certain  weapons  are  too 
brutal  or  non-discriminate  to  ethically  employ  in  war.  An  additional 
stipulation  within  the  Truce  of  God  prohibited  Christians  from  employing 
the  crossbow  in  combat.  Chemical  weapons  like  mustard  gas,  biological 
agents  such  as  anthrax  and  cholera,  and  nuclear  weapons  killed 
hundreds  of  thousands  of  people  on  battlefields  in  both  World  Wars.^o 
One  of  the  more  prominent  reasons  these  weapons  were  developed  was  to 
counter  the  ever-increasing  lethality  of  more  traditional  weaponry.  For 
example,  one  noted  justification  for  the  nuclear  bombs  dropped  on 
Hiroshima  and  Nagasaki  was  that  the  enormous  weapons  shortened  the 
war  and  saved  lives  that  would  have  been  lost  in  a  more  conventional 
invasion  of  mainland  Japan. 21  Following  periods  of  relative  acceptance 
immediately  after  their  creation,  however,  all  three  of  these  types  of 
weapons  were  admonished  by  the  international  community. 
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Several  eomponents  of  just  war  theory  related  to  jus  en  hello  and 
jus  ad  helium  are  eritieal  to  the  arguments  that  follow  in  subsequent 
ehapters  and  deserve  further  development  here.  Childress  dedueed  five 
ethieal  eomponents  eommon  to  most  modern  eonfliets  that  deserve 
speeifie  examination.  These  faetors  will  play  a  signifieant  role  in  the 
diseussion  to  follow  regarding  ethies  in  the  emerging  battlefields  of 
eyberspaee.  The  five  eomponents  are:23 

1.  Good  faith.  When  “perfidy,  bad  faith,  and  treaehery”  are  prevalent 
on  the  battlefield,  restoring  and  maintaining  peaee  beeomes  diffieult. 

The  ethieal  imperative  of  good  faith  insists  prima-facie  obligations  invoke 
the  responsibility  to  treat  one’s  enemies  humanely. Enemy  soldiers  are 
eombatants  who  may  justifiably  be  killed.  Yet  when  eombatants  are 
eaptured  or  wounded,  rendering  them  unable  to  eontinue  fighting,  they 
should  be  treated  humanely. Torture,  maltreatment,  and  withheld 
medieal  eare  undermine  the  good  faith  premise.  Without  this  premise, 
eombatants  understandably  will  eontinue  fighting  at  all  eosts  to  avoid 
heinous  eonsequenees  at  the  merey  of  a  treaeherous  enemy.  If  the 
assuranee  of  good  faith  disappears,  so  does  any  ineentive  for  an 
ineapaeitated  enemy  to  surrender. 

2.  Non-combatant  Immunity.  In  1940  Dr.  John  K.  Ryan  popularized 
the  sentiment  that  eombatants  and  non-eombatants  should  expeet 
different  treatment  in  times  of  war.  Ryan  wrote  “First,  there  is  an 
essential  moral  distinetion  between  innoeent  non-eombatants  and  guilty 
eombatants;  seeond,  the  latter  ean  be  direetly  put  to  death  during  the 
war  and  even,  in  eertain  eases,  after  the  war,  while  innoeent  non¬ 


nuclear  materials  was  prominent  throughout  the  Cold  War  and  continues  to  affect  international  relations 
today. 
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439-442. 
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combatants  can  be  at  most  only  indirectly  put  to  death. Similarly, 
Walzer  writes,  “soldiers  as  a  elass  are  set  apart  from  the  world  of 
peaeeful  aetivity;  they  are  trained  to  fight,  provided  with  weapons, 
required  to  fight  on  command.  No  doubt,  they  do  not  always  fight;  nor  is 
war  their  personal  enterprise.  But  it  is  the  enterprise  of  their  elass,  and 
this  faet  radieally  distinguishes  the  individual  soldier  from  the  eivilians 
he  leaves  behind. The  separation  between  combatants  and  non- 
combatants  hearkens  baek  to  prima-facie  obligations  against  harming  or 
killing  innoeent  people.  It  proposes  a  framework  that  limits  combat  to 
those  who  have  ehosen  to  take  up  arms,  leaving  other  eitizens  free  from 
the  perils  of  war. 

In  modern  war,  one  must  eonsider  who  is  and  who  is  not  a 
eombatant.  In  total  war,  for  instanee,  entire  societies  provide  resourees 
in  manpower,  supplies,  and  funds  to  wartime  efforts.  Childress 
describes  the  distinetion  between  eombatants  and  non-eombatants  as 
“eontextual  and  thus  partially  determined  by  the  soeiety  and  the  type  of 
war. ”28  Irregular  warfare  teehniques  like  guerilla  warfare  and  terrorism 
often  make  basic  differentiation  between  innocent  citizens  and 
warfighters  extremely  diffieult.^^  As  late  as  World  War  I,  armies  isolated 
themselves  on  seeluded  battlefields  and  fought  eaeh  other  in  easily 
identifiable  struggles.  Today,  with  deep  battle  eapabilities  and 
asymmetric  techniques,  eombatants  are  much  less  distinet. 

Some  potential  targets  in  war,  however,  are  both  eivilian  and 
military  in  nature.  In  Operation  Desert  Storm,  for  example,  one  of  the 
first  targets  speeified  in  John  Warden’s  air  campaign  was  Iraq’s  electrical 
grid.^®  Integrated  air  defense  systems  and  Iraq’s  eommand  and  eontrol 
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capabilities  were  inherently  dependent  upon  eleetrieity.  Warden’s 
effeets-based  targeting  seheme  made  the  electrieal  grid  a  viable  military 
target.  However,  hospitals,  businesses,  and  residenees  were  also 
eompletely  reliant  on  eleetrieity  provided  through  the  same  grid.  Walzer 
suggests  the  ethieal  burden  in  this  instanee  rests  with  the  aetors 
involved  to  prove  their  intent  was  a  means  to  an  aeeeptable  effeet  rather 
than  a  retributive  measure  aiming  to  effeet  non-eombatants 
themselves. 

Some  seholars  argue  that  dual-use  targets  are  simply  off-limits  if 
wars  are  to  be  fought  on  ethieal  grounds.  In  an  artiele  titled  The  Morality 
of  Obliteration  Bombing,  John  Ford  argues  “The  prineiple  moral  problem 
raised  by  obliteration  bombing,  then,  is  that  of  the  rights  of  non- 
eombatants  to  their  lives  in  war.”^^  pij-e  bombing  raids  on  Tokyo  and 
Dresden  during  World  War  II,  for  example,  are  often  judged  as  ethieally 
illegitimate,  regardless  of  the  military  advantage  they  produeed.^^  It  is 
eertainly  diffieult  to  imagine  Liddell  Hart’s  “better  peaee”  emerging  from  a 
war  when  entire  cities  and  societies  are  destroyed  while  creating  said 
peaee. 

3.  Proportionality.  Proportionality  in  this  study  suggests  the  amount 
of  foree  used  to  subdue  an  enemy  should  be  held  to  the  minimum  in 
order  to  reduee  unintentional  harm  to  non-eombatants.  Laser  and 
satellite  guided  munitions  like  those  delivered  by  aireraft  in  Operations 
Desert  Storm,  Iraqi  Freedom,  and  Enduring  Freedom,  for  instanee,  are 
eapable  of  delivering  highly  aeeurate  and  seleetive  lethal  foree,  even  in 
urban  environments.^"^  The  responsibility  for  sueh  precision  stems  from 
the  ethieal  obligation  to  limit  non-eombatant  deaths. 
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Going  far  beyond  a  simple  ehivalrie  responsibility,  proportionality 
serves  the  praetieal  purpose  of  seleetively  engaging  eombatants  when 
they  are  surrounded  by  non-eombatants.  This  level  of  diserimination 
helps  to  ensure  neutral  or  friendly  non-eombatants  remain  as  sueh. 
When  means  of  warfare  eause  eivilian  harm  and  are  pereeived  to  be 
disproportionate  in  nature,  new  enemies  are  ereated  that  may  otherwise 
have  remained  disengaged  from  the  war  effort. Thueydides,  deseribing 
the  Athenians’  ruthless  assault  on  Coreyra,  provides  a  telling  historieal 
example.  The  Athenians  adopted  a  eourse  of  warfare  that  ineluded 
revenge  killings  and  needless  slaughter.  Thueydides  wrote,  “there  were 
the  savage  and  pitiless  aetions  into  whieh  men  were  earned  not  so  mueh 
for  the  sake  of  gain  as  beeause  they  were  swept  away  into  an  interneeine 
struggle  by  their  ungovernable  passions. The  eitizens  of  Coreyra  who 
witnessed  these  events  and  survived  dedieated  their  lives  to  the  forees 
united  against  Athens. 

Nuelear  targeting  provides  the  quintessential  ease  study  for  the 
ethieal  boundaries  of  proportionality.  It’s  hard  to  imagine  a  seenario  in 
whieh  a  weapon  eapable  of  destroying  an  entire  eity  eould  be  eonsidered 
proportionate  to  a  dissimilar  military  threat.  Nuelear  weapons  eannot 
diseern  between  eombatants  and  non-eombatants.  Yet  great  minds  like 
Thomas  Sehelling  argue  that  the  value  of  nuelear  weapons  is  not  in  their 
use,  but  in  their  potential  -  their  non-use. Nuelear  weapons  are  so 
terrif3dngly  lethal  that  they  have  produeed  a  perverse  peaee  in  whieh 
assured  nuelear  retaliation  begets  nuelear  aggression. Kant’s  theory  of 
international  polities,  for  instanee,  suggests  states  may  learn  enough 
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from  the  suffering  and  devastation  of  war  to  adhere  voluntarily  to  an 
ordered,  relatively  peaeeful  eoexistenee."^®  An  ethieal  argument  ean  be 
made,  therefore,  that  a  earefully  managed  nuelear  balanee  helps 
maintain  a  healthy  strategie  environment,  thereby  preserving  the  lives 
that  would  be  lost  if  nuelear  weapons  were  unleashedA^ 

4.  Last  Resort.  Jus  ad  bellum  rests  on  the  bedroek  assumption  that  all 
feasible  alternatives  short  of  war  have  been  exhausted  before  resorting  to 
the  use  of  foreeA^  Diplomatie  alternatives,  eeonomie  pressures,  and  even 
threats  of  violenee  baeked  by  supporting  military  eapabilities  have  all 
shown  to  be  effeetive  to  some  degree  at  dispelling  tension  or  eoereing 
adversaries^^  Considering  options  short  of  war  also  upholds  the  prima- 
facie  obligation  against  doing  unneeessary  harm. 

Two  wars  that,  when  eompared,  exemplify  the  notion  of  last  resort 
are  the  United  States’  1991  and  2003  engagement  in  Iraq.  In  1991,  the 
United  States  went  to  great  diplomatie  lengths  to  persuade  Saddam 
Hussein  to  withdraw  his  forees  from  Kuwait  after  he  aggressively  invaded 
the  eountry.  After  months  of  negotiations  and  pressure,  the  United 
States  issued  a  final  ultimatum  to  withdraw,  leaving  a  full  forty-eight 
hours  for  Iraq’s  leadership  to  faeilitate  the  removal  of  their  forees  from 
Kuwaiti  soil.  When  the  final  ultimatum  was  ignored,  leaving  Kuwaiti 
eitizens  under  illegitimate  oppression,  the  Iraqis  were  driven  from  Kuwait 
by  foree.4'^  On  the  eontrary,  Ameriea’s  preventative  war  with  Iraq  in 
2003  rested  on  assumptions  that  Iraq  and  its  assoeiates  posed  a  dire 
threat  to  the  United  States,  regardless  of  their  intentions  to  immediately 
launeh  an  attaek.  Riehard  Haass,  a  presidential  advisor  during  both 
wars,  ealled  the  1991  Gulf  War  a  “war  of  neeessity”  and  the  2003  eonfliet 
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“a  war  of  choice. The  ehasm  between  prevention  and  preemption  - 
neeessity  and  ehoiee  -  requires  signifieant  ethieal  debate. 

An  alternative  definition  of  last  resort  suggests  war  should  be  the 
least  desirable  eourse  of  aetion,  but  not  neeessarily  the  last  ehoiee. 
Israel’s  preemptive  partieipation  in  the  Six  Day  War  of  1967  offers  a 
eounter  example  that  illustrates  what  Walzer  ealls  “a  elear  ease  of 
legitimate  antieipation.’’^^  Several  Israeli  intelligenee  sourees  and 
diplomatie  outlets  eorroborated  reports  that  overwhelming  Egyptian 
military  power  was  amassed  to  invade  Israel.  The  ensuing  Israeli 
surprise  attaek  against  the  Egyptians  was  most  eertainly  not  eondueted 
onee  all  other  options  were  tried.  However,  history  refleets  positively  on 
the  attaek  as  a  justified  use  of  offensive  military  power  for  neeessary  self- 

defense. ^7 

The  eoneept  of  last  resort,  however  it  is  defined,  is  one  that  rests 
on  solid  ethieal  ground.  Just  war  theory  preeludes  aggression.  Any 
instanee  where  feasible  options  short  of  war  are  foregone  or  ignored 
introduees  the  distinet  possibility  that  aggressive  intentions  underpin 
one’s  aetions.  However,  when  threats  overrun  otherwise  peaeeful  and 
eooperative  alternatives,  justified  foree  may  emerge  as  the  most 
reasonable  eourse  of  aetion. 

5.  Intervention/ Sovereignty.  The  final  eomponent  of  just  war  theory 
that  deserves  speeifie  mention  in  this  study  involves  the  sanetity  of  state 
sovereignty  juxtaposed  with  the  requirement  to  promote  peaee. 

Beginning  with  the  Peaee  of  Westphalia  in  the  mid  1600’s  the  world’s 
politieal  landseape  eontinually  evolved  into  an  intereonneeted  web  of 
sovereign  states. While  international  institutions  like  the  United 
Nations  and  its  predeeessor,  the  League  of  Nations,  have  attempted  to 
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govern  inter-state  relations,  no  world  order  has  emerged  as  of  yet  to 
trump  the  system  of  geographieally  separate,  self-governing  nation¬ 
states. Allianees  and  eoalitions  help  maintain  stability  by  balaneing 
world  power.  However,  no  organizational  element  has  the  viability  of 
each  individual  country.  Strong  international  norms  and  legal 
parameters  require  a  high  threshold  of  justification  for  violation  of  state 
sovereignty.  Walzer  places  such  a  high  importance  on  sovereignty  that 
he  suggests  it  can  only  be  breached  in  response  to  “acts  that  shock  the 
moral  conscience  of  mankind.”^® 

Sovereignty,  however,  creates  a  prima-facie  dilemma  when  the 
leadership  of  a  country  is  either  incapable  of  protecting  its  citizens  or  it 
becomes  a  source  of  inhumane  treatment.  One  must  weigh  justice 
versus  life  if  one  desires  to  create  peace  where  sovereignty  acts  as  a 
barrier.  Natural  law  theorists,  for  example,  believe  human  beings  have 
the  moral  obligation  to  protect  other  humans  from  harm,  regardless  of 
existing  structures,  norms,  or  guidelines. Relatively  weak  nations  and 
classicists,  on  the  other  hand,  argue  that  intervention  usually  occurs 
when  a  powerful  culture  wishes  to  impose  its  ideals  and  norms  on  the 
less  powerful. a  situation  one  nation  perceives  as  a  moral  crisis 
requiring  intervention  may  simply  be  the  status  quo  or  a  cultural  norm 
to  another. 

Walzer’s  idea  justifying  intervention  in  situations  that  shock  the 
human  conscience,  however,  is  powerful  indeed.  Certainly,  high 
thresholds  are  necessary  to  prevent  the  subversion  of  sovereignty  at  the 
whim  of  powerful  nations.  Standards  of  acceptability  and  human  rights 
are  difficult  to  generalize.  As  Jack  Donnelly  observes,  “Just  as  in 
domestic  politics,  governments  are  free  to  adopt  legislation  with 
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extremely  weak,  or  even  non-existent,  implementation  measures,  states 
are  free  to  ereate  and  aeeept  international  legal  obligations  that  are  to  be 
implemented  entirely  through  national  aetion.  And  this  is  in  faet  what 
states  have  done  with  international  human  rights.  None  of  the 
obligations  to  be  found  in  multilateral  human  rights  treaties  may  be 
eoereively  enforeed  by  any  external  aetor.”^^  Historieal  examples  from  the 
last  three  deeades  alone  of  atroeities  in  Rwanda,  Somalia,  Darfur, 

Kosovo,  Haiti,  and  elsewhere  around  the  world  suggest  an  agreeable 
threshold  exists  to  satisfy  jus  ad  bellum  requirements  of  ethieal 
intervention. 

It  is  within  this  ethieal  framework  that  we  must  taekle  the  diffieult 
questions  we  faee  regarding  the  justiee  o/war  and  justiee  in  war.  While 
poliey-makers  deeide  whether  a  war  itself  is  justified,  individual  soldiers 
must  examine  whom  to  kill  and  how  to  kill  them.^^  These  eonsiderations 
have  endured  as  long  as  warfare  itself.  While  the  eharaeter  of  war  and 
the  domains  of  warfare  have  ehanged,  the  nature  of  war  and  its  ethieal 
underpinnings  have  remained  eonstant.  Yet  as  we  lead  headlong  into  the 
wild  frontier  of  eyberspaee  we  must  redress  elassieal  assertions  of  right 
and  wrong.  With  the  new  eapabilities  proposed  by  the  eyber  domain 
eome  new  responsibilities,  fundamentally  altered  assumptions,  a  vaeuum 
of  norms,  and  ethieal  questions  begging  for  answers.  If  we  are  to  use 
this  domain  for  aets  of  war  we  must  earefully  eonsider  the  ethieal 
ramifieations  of  our  aetions. 


As  quoted  in  Hoizgrefe  and  Keohane,  Humanitarian  Intervention,  44. 
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Chapter  3 

Ethics  of  Cyber  Warfare 


The  previous  ehapter  deseribed  a  framework  for  ethieal  warfare. 
This  ehapter  overlays  the  jus  ad  bellum  and  jus  en  bello  standards  that 
have  eome  to  define  ethieal  warfare  with  unique  eonsiderations  that 
eyberspaee  and  eyber  warfare  bring  to  war.  In  some  instanees,  the 
traditional  just-war  standards  apply  as  neatly  in  eyberspaee  as  they  do 
in  any  other  domain.  In  most,  however,  the  nature  of  eyberspaee  and  the 
eapabilities  the  domain  faeilitates  gives  eause  to  rethink  how  we  interpret 
our  traditional  mindset  regarding  ethies  in  war.  Eaeh  faeet  presented  in 
the  foundational  diseussion  of  ehapter  2  is  broken  out  in  detail  below. 

Good  Faith 

The  ethieal  premise  of  good  faith  offers  eombatants  in  traditional 
wars  assuranees  and  options.  Based  largely  on  prima-facie  obligations, 
the  good  faith  imperative  allows  for  ethieal  treatment  of  eombatants 
when  they  are  ineapaeitated  or  they  ehoose  to  surrender.  For  example, 
wounded  or  siek  eombatants  are  guaranteed  proteetion  under  the  terms 
of  the  Geneva  and  Hague  eonventions.^  The  same  eonventions  outline 
proeedures  and  expeetations  for  eombatants  who  willingly  surrender  or 
who  beeome  prisoners  of  war. 2  These  established  expeetations 
underwrite  brutal  eombat  with  mutually  aeeepted  humanitarian  norms. 

Good  faith  between  eombatants  plays  a  pivotal  role  in  that  it  allows 
wars  to  end  without  one  party  obliterating  the  other.  Enemy  soldiers, 
eitizens,  or  poliey  makers  who  expeet  brutal,  treaeherous  treatment  at 
the  hands  of  their  opponent  are  not  likely  to  surrender.  It  is  hard  to 
imagine,  for  example.  Emperor  Hirohito  aeeepting  the  allies’  terms  of 
surrender  at  the  end  of  World  War  11  if  he  believed  allied  forees  would 

^  Michael  Bothe,  Karl  Josef  Partsch,  and  Waldemar  A.  Solf,  New  Rules  for  Victims  of  Armed  Conflicts: 
Commentary  on  the  Two  1977  Protocols  Additional  to  the  Geneva  Conventions  of  1949  (Martinus  Nijhoff 
Publishers,  1982),  3. 

^  Bothe,  Partsch,  and  Solf,  New  Rules  for  Victims  of  Armed  Conflicts,  6. 
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ravage  Japan  an5rway.^  Good  faith  impacts  both  when  and  how  wars  are 
fought  so  it  serves  naturally  important  roles  in  both  jus  ad  bellum  and 
jus  en  bello. 

One  must  reexamine  several  commonly  accepted  ideas  of  warfare 
in  order  to  establish  the  groundwork  for  good  faith  in  cyber  warfare. 

First,  fighters  in  cyberspace  are  often  unnamed,  unaffiliated,  and  difficult 
to  pinpoint. 4  Second,  specific  attribution  is  difficult  even  in  attacks  that 
are  carried  out  by  identifiable  sources.^  Finally,  time  and  space 
considerations  change  the  ways  in  which  fighters  in  cyberspace  can  be 
threatened  or  quelled.  These  considerations  are  particularly  important 
when  response  options  are  limited  to  coercive  physical  threats. 

Incentives  to  surrender  change  entirely  when  they  cannot  be  elicited  by 
threatening  belligerent  parties.  However,  cyber  warfare  may  also  offer 
the  military  strategist  legitimate,  non-lethal  ways  to  achieve  desired 
ends.  In  this  way,  cyber  warfare  proposes  novel  methods  by  which  to 
avoid  treachery  altogether.  All  of  these  complicated  facets  form  a  new 
understanding  of  good  faith  in  the  realm  of  cyberspace. 

An  apt  place  to  start  when  examining  the  premise  of  good  faith  in 
cyber  warfare  is  to  identify  the  combatants.  The  term  combatant 
traditionally  describes  a  person  who  directly  participates  in  warfare  on 
behalf  of  a  nation  state,  or  someone  who  offers  direct  support  to  warring 
forces.^  This  distinction  is  important  because  combatants  may  be 
targeted  legally  under  the  Law  of  Armed  Conflict.'^  However,  the 


^  Tsuyoshi  Hasegawa,  Racing  the  Enemy:  Stalin,  Truman,  and  the  Surrender  of  Japan  (Harvard  University 
Press,  2005),  215. 
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1  (Spring  2014):  118. 
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definition  of  the  term,  and  the  eireumstanees  surrounding  its  use, 
evolved  as  methods  of  warfare  have  ehanged. 

The  age  of  total  war,  eoupled  with  the  ability  to  strike  deep  within 
enemy  territories,  blurred  the  lines  between  eombatants  and  non- 
eombatants.^  Deep  strikes  took  wars  to  enemy  territories  that  were 
previously  immune  to  battlefield  effeets.  In  total  wars,  partieularly  the 
two  World  Wars,  the  eitizenries  of  entire  nations  were  mobilized  in 
support  of  war  efforts,  giving  some  justifieation  to  the  idea  that  the  line 
between  eombatants  and  non-eombatants  no  longer  existed.  In  World 
War  11,  for  example,  aireraft  faetories  and  meehanieal  plants  manned  by 
eivilian  German  eitizens  were  eonsidered  legitimate  military  targets  even 
though  it  would  be  a  streteh  to  eall  the  faetory  workers  themselves 
eombatants.^ 

The  asymmetrie  eonfliets  of  the  2 1  st  Century  further  eomplieated 
the  ways  in  whieh  eombatants  and  non-eombatants  are  differentiated. 
Ameriean  rules  of  engagement  in  Afghanistan,  for  instanee,  labeled 
nearly  anyone  who  demonstrated  “hostile  intent”  a  eombatant.^^  This 
vague  definition,  eoupled  with  striet  limits  on  the  aeeeptability  of 
eollateral  damage,  foreed  warfighters  at  the  lowest  taetieal  levels  to 
deeide  what  hostile  intent  looked  like  while  bullets  eareened  through  the 
air.  Or  eonversely,  eombatants  in  these  irregular  wars  found  themselves 
advantaged  by  the  ambiguity  between  aeeeptable  and  unaeeeptable 
engagement. 

If  eombatants  in  irregular  warfare  enjoy  advantages  of  ambiguity, 
eombatants  in  eyberspaee  are  all  but  invisible. General  Wesley  Clark 
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and  Peter  Levin  eontend  “There  is  no  form  of  military  eombat  more 
irregular  than  an  eleetronie  attaek:  it  is  extremely  eheap,  is  very  fast,  ean 
be  earned  out  anonymously,  and  ean  disrupt  or  deny  eritieal  serviees 
preeisely  at  the  moment  of  maximum  peril. Warfighters  in  eyberspaee 
may  infeet  information  systems  years  in  advanee  of  aetual  eombat 
operations,  leaving  latent  weapons  eapable  of  destroying  or  disrupting 
their  targets.  It  is  thought,  for  example,  that  the  Stuxnet  eomputer  virus 
that  damaged  nuelear  eentrifuges  in  Iran’s  Natanz  enriehment  faeility  in 
2010  may  have  been  introdueed  into  the  systems  elandestinely  as  early 
as  2005.13 

Careto,  an  advaneed  eyber  threat  uneovered  by  Russia’s  Kaspersky 
Labs  in  February,  2014,  serves  as  another  telling  example.  Careto 
infiltrated  eomputer  systems  in  embassies  and  other  government 
faeilities  within  30  Spanish  speaking  eountries  undeteeted  sinee  at  least 
2007.14  Cyber  warfighters  ean  ereate  eyber  weapons  that  replieate 
themselves,  morph  to  ehanging  eireumstanees,  or  spawn  subsequent 
infeetions  autonomously  while  weapons  lay  in  waiting.  In  these 
instanees,  the  eombatants  who  ereate  and  introduee  weapons  into  enemy 
information  systems  in  the  first  plaee  have  almost  assuredly  vanished 
baek  into  the  worldwide  populous  of  non-eombatants  onee  hostilities 
eommenee. 


specific  sources.  Even  the  most  sophisticated  independent  actors,  Internet  security  firms,  and  nations 
operating  in  cyberspace  seldom  find  convincing  evidence  that  links  attacks  to  specific  actors. 
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Active  cyber  warfighters  engaged  in  real-time  attacks  are  also 
extraordinarily  difficult  to  identify  and  engage.  Cyber  warfighters  may 
execute  their  craft  at  great  distances  from  their  targets.  The  worldwide 
nature  of  cyberspace  makes  it  possible  to  initiate  attacks  from  almost 
an3rwhere  on  the  globe  instantaneously.  Sophisticated  adversaries  are 
rarely  able  to  navigate  complicated  labyrinths  of  information  systems  to 
follow  cyber-attacks  back  to  their  specific  electronic  origins.  The  Internet 
and  its  larger  cyberspace  linkages  are  not  designed  in  a  way  that  favors 
positive  identification  and  ownership. Connecting  elusive  electronic 
signatures  to  physical  locations  and  individual  attackers  is  even  more 
difficult.  Even  in  the  rare  instances  where  exact  physical  origins  of 
cyber-attacks  are  determined,  the  combatants  who  perpetuated  the 
attacks  seldom  remain  in  physical  proximity  to  the  systems  they  used.!”^ 
The  combatants  themselves  are  human  beings  but  their  operating 
environments  and  weapons  are  virtual,  fleeting,  and  nebulous. 

Nation  states  rightly  find  tremendous  advantages  in  the 
anonymous  and  non-attributable  nature  of  cyber  warfare.  By  remaining 
anonymous,  states  retain  the  option  to  deny  their  actions  in  politically 
sensitive  situations  while  achieving  desired  effects.  Relatively  weak 
nation  states  find  themselves  emboldened  to  attack  stronger  adversaries 
using  cyber  weapons  when  physical  attacks  would  be  politically  or 
militarily  untenable.  The  Syrian  Electronic  Army  (SEA),  for  example,  is  a 
loosely  affiliated  group  of  programmers  and  activists  within  Syria  that 
aims  to  counter  potential  American  involvement  in  Syria’s  ongoing  civil 
struggle.  The  SEA  launched  a  wave  of  cyber-attacks  against  American 
interests  in  2013-14  while  hidden  in  the  ambiguity  of  cyberspace.  These 
attacks  defaced  numerous  American  information  systems  and  even 
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brought  down  the  New  York  Times  website  for  an  entire  dayd^  Physieal 
attaeks  that  produeed  the  same  level  of  destruetion  would  have  left 
attaekers  exposed  to  potential  retaliation  or  physieal  harm.  In 
eyberspaee,  however,  the  eombatants  maneuvered  with  impunity. 

Anonymity  and  non-attribution  in  eyber  warfare  benefit  strong 
nations  as  well.  These  faetors  allow  nations  responsible  for  ereating  and 
maintaining  international  norms  to  aet  outside  existing  ethieal  standards 
without  fear  of  politieal  baeklash.  For  instanee,  eyber  forensies  experts 
traeed  numerous  eyber-attaeks  launehed  against  the  republie  of  Georgia 
in  2008  baek  to  information  systems  in  Russia.  Laeking  proof  that 
speeifieally  implieated  the  Russian  government  in  the  attaeks,  however, 
the  international  eommunity  was  left  without  justifieation  for  retaliatory 
aetions  against  Russia. 20  Additionally,  anonymity  and  autonomy  ereate 
military  advantages  in  eontested  environments  in  the  same  way  stealth 
teehnology,  eruise  missiles,  and  remotely  piloted  aireraft  do.  Nation 
states  are  ineentivized  to  maintain  eapabilities  to  surprise  and  deeeive 
their  enemies  in  eyberspaee  in  the  same  ways  they  are  in  the  physieal 
realms. 

Anonymity  and  non-attribution,  however,  undermine  the  premise 
of  good  faith.  Treaties,  agreements,  and  norms  -  the  basis  upon  whieh 
good  faith  rests  -  all  depend  on  aeeountability  and  attribution.  Treaties 
and  norms  are  only  viable  forms  of  restraint  for  nation  states  that  ean  be 
held  aeeountable  for  their  aetions.  When  aetions  are  attributable  to 
legitimate  aetors  on  the  global  stage,  the  aetors  themselves  have 
ineentives  to  aet  ethieally  for  fear  of  retribution  or  global  eondemnation. 
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Nuclear  deterrence,  for  example,  is  built  on  the  assumption  that  nuclear 
weapons  have  return  addresses.  Launching  or  dropping  a  nuclear 
weapon  requires  significant  delivery  capabilities,  each  of  which  has 
signatures  that  identify  a  weapon’s  source.  Attribution  and 
accountability  go  hand  in  hand  to  form  the  basis  for  ethical  actions  in 
war. 

Given  the  sanctuary  from  which  cyber  combatants  operate,  where 
little  fear  of  reprisal  and  even  less  fear  of  physical  harm  are  routine 
expectations,  one  must  consider  whether  incentives  to  surrender  even 
apply.  Soldiers  in  modern  conventional  wars  surrender  when  they  run 
out  of  physical  or  psychological  options. 21  In  Operation  Desert  Storm,  for 
example,  Iraqi  forces  surrendered  by  the  thousands  when  they  were 
encircled  or  when  psychological  operations  forces  were  able  to  convince 
the  Iraqis  that  they  had  no  chance  of  success. 22  In  cyberspace,  however, 
enemies  that  are  psychologically  defeated  still  retain  physical  freedom  of 
maneuver.  Additionally,  combatants  in  cyberspace  retain  the  option  to 
enter  and  exit  the  domain  as  they  see  fit. 

The  absence  of  practical  ways  to  identify  and  locate  attackers  in 
cyberspace  is  troubling.  The  political  and  military  incentives  for  nations 
to  retain  deniability  are  worrying.  The  ability  to  strike  an5nvhere  in 
cyberspace  en  masse  or  individually  is  unsettling.  All  of  these  factors 
combine  to  create  a  scenario  where  traditional  terms  of  surrender  and 
ethical  treatment  found  in  the  Geneva  and  Hague  Conventions  are 
rendered  nearly  absurd.  Combatants  who  face  little  fear  of  retribution 
should  be  expected  to  fight  until  their  means  or  desires  to  do  so  are 
depleted.  Therefore,  the  world  is  at  a  critical  juncture  with  regard  to  the 
good  faith  premise  in  cyber  warfare.  While  nations  are  incentivized  in 
myriad  ways  to  act  subversively,  these  temptations  erode  stability. 

Norms  of  behavior  established  today  will  serve  as  the  examples  for  the 
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future. These  norms  should  favor,  rather  than  undermine,  peaee. 
Aetors  in  eyberspaee  should  rely  on  jus  ad  bellum  and  jus  en  bello 
eonsiderations  for  the  altruistie  merit  these  guidelines  exhibit.  Yet  these 
same  guidelines  also  ereate  utilitarian  advantages  in  that  they  establish 
standards  that  foster  mutually-aeeeptable  norms  and  a  more  predietable 
operating  environment  struetured  around  aeeeptable  and  unaeeeptable 
limits. 

Through  a  different  lens,  however,  eyber  warfare  may  aetually  help 
to  redefine  the  good  faith  premise  in  a  way  that  reduees  violenee  in 
war. 24  Traditionally,  weapons  and  taeties  of  war  endure  development 
eyeles  that  forestall  ethieal  judgment  until  after  these  new  eapabilities 
are  fielded  and  used.  Praetiees  that  are  deemed  treaeherous,  sueh  as  the 
employment  of  poisonous  gasses  and  maiming  land  mines,  are 
eondemned  by  the  international  eommunity  and  exeluded  from  future 
wars.  From  the  erossbow  to  nuelear  intereontinental  ballistie  missiles, 
modern  weapons  trend  toward  inereasingly  lethality.  While  the  world 
may  never  witness  a  full-blown  eyber  war,  many  of  the  eapabilities  that 
have  emerged  in  this  domain  offer  trustworthy  methods  to  disarm 
eombatants  or  negate  defenses  from  great  distanees  with  less  violenee  or 

treaehery.25 

Carl  von  Clausewitz  famously  established  a  framework  of  war  that 
involves  three  inextrieable  eomponents:  primordial  violenee,  poliey,  and 
ehanee.26  Clausewitz  surmises,  “A  theory  that  ignores  any  one  of  [these 
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three  elements]  or  seeks  to  fix  an  arbitrary  relationship  between  them 
would  eonfliet  with  reality  to  sueh  an  extent  that  for  this  reason  alone  it 
would  be  totally  useless. Yet  eyber  warfare  tugs  at  the  eonneetion 
between  violenee  and  war.  If,  for  example,  a  military  beeomes  so  reliant 
on  information  systems  that  it  eannot  exeeute  a  eoordinated  eampaign 
without  them,  eyber  weapons  may  be  eapable  of  rendering  the  military 
inert.  A  thorough  examination  of  this  faeet  is  eontained  in  the 
diseussion  on  proportionality,  but  it  is  important  to  note  the  theoretieal 
possibility  that  eyber  weapons  may  reshape  the  good  faith  imperative  by 
redueing  seenarios  in  whieh  treaehery  is  even  possible. 

Many  of  the  eomplieating  faetors  surrounding  eyber  warfare  and 
the  good  faith  premise  are  exaeerbated  by  the  eurrent  state  of  teehnology 
available  to  eyber  warfare  praetitioners.  The  medium  of  eyberspaee  and 
the  praetieal  teehnieal  eapabilities  of  eyber  warfare  evolve  so  rapidly  that 
teehnieal  methods  of  enforeing  ethieal  standards  in  eyberspaee  are  often 
defunet  before  they  are  fielded,  if,  for  instanee,  teehnology  matures  in 
ways  that  make  attribution  of  attaeks  easier,  the  good  faith  premise 
would  be  expeeted  to  apply  to  eyber  warfare  in  ways  understood  more 
traditionally.  The  eurrent  state  of  teehnology,  however,  established  rules 
and  ethieal  norms  must  substitute  for  more  teehnieal  methods  of 
enforeement  until  teehnieal  eapabilities  mature. 

Good  faith,  therefore,  offers  both  troubling  eomplieations  and 
intriguing  opportunities  to  military  strategists.  When  one  wishes  to 
aehieve  military  effeets  anonymously,  eyber  warfare  teehniques  may  very 
well  offer  viable  options.  Conversely,  however,  when  one  wishes  to 
identify  an  adversary,  he  may  be  frustrated  by  the  very  anonymity  he 
enjoyed  in  different  eireumstanees.  Yet  the  ineentives  to  operate  in  eyber 
warfare,  ineluding  the  ability  to  produee  effeets  with  less  lethality  than  in 
other  domains,  makes  eyberspaee  an  operating  environment  that  eannot 
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be  discounted.  Until  technological  safeguards  and  international  laws 
governing  cyber  warfare  emerge,  however,  norms  of  behavior  are  all  that 
separate  barbarism  from  professional  conduct.  These  norms  will  help 
facilitate  an  environment  where  the  good  faith  imperative  applies. 

Proportionality 

Proportionality  in  war  suggests  combatants  should  use  the 
minimum  amount  of  force  required  to  achieve  legitimate  objectives 
without  causing  undue  harm  or  suffering. 28  Walzer  refers  to 
proportionality  as  “a  matter  of  adjusting  means  to  ends.”29  Strong 
connections  between  good  faith  and  non-combatant  immunity  converge 
within  the  principle  of  proportionality.  Combatants  who  measure  means 
to  coincide  with  legitimate  ends,  by  virtue,  adhere  to  many  good  faith 
principles.  The  same  judicious  practices  limit  harm  to  non-combatants 
to  within  ethically  acceptable  limits. 

Both  novel  advances  and  nagging  difficulties  emerge  when  the 
principle  of  proportionality  is  transposed  onto  the  tools  and  capabilities 
of  cyber  warfare.  First,  cyberspace  is  an  inherently  dual-use 
environment.  Forces  capable  of  planning  and  executing  cyber  warfare 
utilize  the  same  transmission  paths,  systems,  and  software  as  peaceful 
participants  in  the  cyber  domain.^®  Next,  the  significant  overlap  with 
unpredictable  commercial  entities  and  civilians  makes  cyberspace  a  fluid 
environment.  This  unpredictability  makes  it  difficult  to  measure  the 
actual  effects  of  cyber  weapons  against  their  anticipated  effects.^^ 

Finally,  this  section  will  address  possible  ways  in  which  cyber  warfare 
potentially  enhances  the  idea  of  proportionality  by  offering  less  lethal 
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means  to  achieve  desired  ends.  In  theory,  cyber  weapons  can  be 
extraordinarily  accurate  in  ways  kinetic  weapons  cannot.  Strategists, 
tacticians,  and  policy  makers,  however,  must  scrupulously  examine  the 
actual  effects  of  their  actions  in  cyberspace  to  ensure  they  abide  by 
ethically  acceptable  standards  of  proportionality. 

The  distinction  between  military  and  non-military  systems  in 
cyberspace  is  much  more  convoluted  than  it  is  in  the  traditional  realms 
of  air,  space,  sea,  and  land.  Tanks  are  able  to  lumber  across  land 
regardless  of  whether  civilian  roads  are  available.  Air  forces  only  require 
access  to  airfields  in  order  to  project  power  through  the  air.  Naval 
vessels,  in  and  of  themselves,  are  often  depicted  as  forward  extensions  of 
sovereignty  and  national  power  through  the  world’s  oceans.  However, 
combatants  engaged  in  cyber  warfare  are  often  completely  reliant  on 
commercial  fiber  optic  cables,  satellite  links,  airwaves,  and  traffic  routing 
systems.  The  201 1  Department  of  Defense  Strategy  for  Operating  in 
Cyberspace  says  “The  challenges  of  cyberspace  cross  sectors,  industries, 
and  U.S.  government  departments  and  agencies;  they  extend  across 
national  boundaries  and  through  multiple  components  of  the  global 
economy.  In  fact,  cyberspace  would  not  exist  without  the  manmade 
backbone  of  electronic  devices  on  which  it  functions. Many  of  DoD’s 
critical  functions  and  operations  rely  on  commercial  assets,  including 
Internet  Service  Providers  (ISPs)  and  global  supply  chains,  over  which 
DoD  has  no  direct  authority  to  mitigate  risk  effectively. Additionally, 
the  actual  systems  used  by  combatants  in  cyberspace  are  usually 
supplied  by  commercial  vendors  in  configurations  that  are  widely 
available  to  the  public.  The  United  States,  for  example,  codified  the 
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requirement  to  use  eommereial,  off-the-shelf  (COTS)  technology  where 
feasible  in  1994  and  this  trend  has  continued  for  two  decades. 

When  cyber  forces  operate  through  commercial  transport  and 
computing  systems,  the  cyber  battlefield  becomes  an  enmeshed  tapestry 
of  protected  systems,  viable  targets,  and  neutral  entities.  In  this  way, 
cyber  warfare  encounters  many  of  the  challenges  that  have  come  to 
exemplify  irregular  warfare.  In  his  book.  War  from  the  Ground  Up: 
Twenty-First  Century  War  as  Politics,  Emile  Simpson  writes  “Today,  even 
relatively  conventional  wars  are  not  fought  entirely  within  a  sealed 
military  domain.  The  means  of  war  are  not  just  combat. Simpson 
carries  this  argument  toward  an  important  conclusion  when  he  suggests 
“In  terms  of  military  jargon,  one  has  to  distinguish  between  ‘means’  and 
‘effects.’”^®  Warfighters  in  the  traditional  domains  must  balance  how 
their  actions  affect  their  surroundings.  Cyber  warfighters,  too,  have  a 
responsibility  to  understand  how  their  actions  impact  the  domain  of 
cyberspace  itself. 

Viruses  and  botnets  are  two  examples  of  weapons  in  cyberspace 
that  can  produce  detrimental  effects  on  the  domain  itself.  Viruses 
spread  between  computers  by  infecting  files  within  their  host  systems. 
Botnets  are  groups  of  compromised  computers,  often  numbering  in  the 
millions,  that  are  manipulated  through  command  and  control  software  to 
carry  out  collective  acts  of  cyber  warfare. Both  of  these  capabilities 
produce  damaging  side  effects.  Viruses  destabilize  all  of  the  information 
systems  they  infect,  regardless  of  whether  the  systems  were  targeted 
intentionally.  Botnets  often  impede  legitimate  Internet  traffic,  degrade 
system  access,  and  overflow  network  traffic  management  systems  that 
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serve  entities  unrelated  to  the  attaeks.  The  eollateral  effeets  these  eyber 
weapons  produee  are  at  the  heart  of  the  proportionality  debate. 

The  United  Nations  International  Teleeommunieations  Union  (ITU) 
ehampions  the  notion  that  Internet  aeeess  promotes  soeio-eeonomie 
growth  and  human  prosperity.  Efforts  to  promote  broadband 
eonneetivity  throughout  impoverished  areas  of  the  world  are  underway 
with  the  stated  goals  of  fairness,  justiee,  and  eeonomie  viability  for  all.^s 
If  the  ITU  is  eorreet  in  its  assessment  that  unobstrueted  eonneetivity 
should  be  treated  as  a  basie  human  right,  indiseriminate  behavior  in 
eyberspaee  ean  have  the  seeondary  effeet  of  limiting  this  important 
souree  of  development.^^  Failure  to  eare fully  limit  eollateral  damage 
assoeiated  with  eyber  weapons  ean  undermine  peaeeful  and  prosperous 
uses  of  the  eyberspaee  domain.  Cyber  warfare  strategists  must  measure 
the  effeets  they  aim  to  aehieve  versus  the  assoeiated  seeondary  eosts 
when  deeiding  whether  proportionality  is  adequately  addressed. 

Seeondary,  unintended  effects  are  not  limited  to  the  logical 
domain.  Cyber  weapons  can  also  produce  unintended  physical  effects. 
Attacks  against  Supervisory  Control  and  Data  Acquisition  (SCADA) 
systems  serve  as  a  case  in  point.  SCADA  systems  are  designed  to 
interface  with  industrial  control  systems  to  more  efficiently  manage 
pipeline  systems,  electrical  grids,  and  several  other  civil  support  systems. 
SCADA  systems  rely  on  programmable  logic  controllers  that  are  not 
unique  to  the  systems  they  support. Instead,  these  controllers  support 
a  variety  of  SCADA  connections.  Vulnerabilities  that  exist  in  electrical 
grids,  therefore,  may  also  be  present  in  water  pipelines  and  sewage 
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management  systems  using  similar  programmable  logie  eontrollers. 
Justifiable  attaeks  against  military  eleetrieity  sourees,  for  example,  ean 
spread  through  a  variety  of  methods  to  eause  unintended  damage  in 
systems  unrelated  to  the  aetual  targets. 

The  ability  to  test  and  prediet  how  eyber  weapons  will  aet  when 
they  are  employed  is  another  souree  of  ethieal  eontention.  Edward 
Barrett  of  the  Stoekdale  Center  for  Ethieal  Leadership  at  the  US  Naval 
Aeademy  addressed  this  speeifie  issue  in  an  artiele  titled  Warfare  in  the 
New  Domain:  The  Ethics  of  Military  Cyber  Operations.  Barrett  writes 
“Sinee  well-tested,  human-launehed  kinetie  weapons  operate  within 
natural,  stable,  and  relatively  knowable  eonditions,  their  effeets  are 
predietable...But  eyber-attaek  effeets  may  be  highly  unpredietable  due  to 
their  human-ereated  and  thus  ehanging  eyber-environment.’’^!  While 
some  may  see  eollateral  damage  of  this  nature  as  simply  a  eost  of  war, 
eyber  warfare  offers  unique  eireumstanees  that  have  not  been 
eneountered  in  other  forms  of  warfare.  For  example,  Patriek  Lin,  Fritz 
Allhoff,  and  Neil  Rowe  opine  “laek  of  eontrol  means  an  attaek  might  not 
be  able  to  be  ealled  off  after  the  vietim  surrenders.”^^  a  virus 
propagating  through  eyberspaee,  or  an  autonomous  worm  traversing 
through  networks  pays  little  mind  to  peaee  treaties.  Strategists  must 
eonsider  this  faeet  of  eyber  warfare  if  these  tools  are  to  be  used  in  war. 

The  examples  above  eapture  both  jus  ad  bellum  and  jus  en  bello 
eonsiderations  that  must  be  addressed  in  any  ethieal  measurement  of 
eyber  warfare.  Cyber  weapons  ean  potentially  alter  the  very  domain  in 
whieh  they  operate  in  ways  that  eannot  be  tested.  The  very  presenee  of 
these  unknown  effeets,  and  the  potential  damage  that  may  ensue,  must 
be  eonsidered  when  deeiding  whether  to  employ  eyber  weapons. 

Stuxnet,  one  of  the  most  sophistieated  and  speeialized  eyber  weapons 
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known,  for  example,  spread  onto  untargeted  systems  when  humans 
inside  the  Iranian  nuelear  plant  at  Natanz  inadvertently  transferred  the 
infeetious  eode  on  portable  data  storage  deviees."^^  While  Stuxnet  eaused 
little  damage  onee  it  left  Natanz,  the  next  malieious  eode  of  this  variety 
might  bring  substantial  unantieipated  effeets.  Metieulous  eare  must  be 
taken  to  examine  the  instanees  in  whieh  requirements  for  eertainty 
outweigh  the  potential  unknowns  eyber  weapons  introduee.  Tense 
politieal  eonfliets,  for  instanee,  require  earefully  ealeulated  moves  in 
order  to  avoid  inadvertent  esealation.  Unantieipated  eyber  effeets  may  be 
all  that  is  required  to  tip  the  balanee  of  eontrol  in  a  eonfliet  of  this  sort. 

One  eannot  assume  that  eyber  warfare  aetions  will  be  met  strietly 
with  in-kind  responses.  The  United  States  National  Military  Strategy  for 
Cyberspaee  Operations  states  “DOD  will  eonduet  kinetie  missions  to 
preserve  freedom  of  aetion  and  strategie  advantage  in  eyberspaee.”^^ 

One  US  Offieial  is  quoted,  saying  "If  you  shut  down  our  power  grid, 
maybe  we  will  put  a  missile  down  one  of  your  smokestaeks.''^^  No 
instanees  of  direet  kinetie  responses  to  eyber-attaeks  have  been 
doeumented  to  date.  However,  it  is  no  streteh  to  prediet  that  as  aets  of 
eyber  warfare  inerease  in  intensity,  nations  beeome  more  dependent  on 
their  eyber  systems  for  normal  state  funetions,  and  eyber  warfare  aetions 
tend  toward  autonomy  without  humans  direetly  tied  to  deeision-eyeles, 
esealation  from  the  eyber  domain  to  the  physieal  realm  is  likely.  If  (or 
when)  this  type  of  response  oeeurs,  questions  regarding  proportionality 
will  surfaee  onee  again,  asking  if  eleetronie  attaeks  justify  the  potential 
loss  of  life  assoeiated  with  physieal  responses. 
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The  short  description  of  proportionality  at  the  beginning  of  this 
section  highlighted  two  important  characteristics.  First,  combatants 
should  seek  to  accomplish  their  goals  with  minimal  harm  or  suffering. 
The  debate  thus  far  has  focused  on  that  important  clause.  The  second 
characteristic  of  proportionality,  however,  is  the  idea  that  combatants 
should  use  the  minimum  amount  of  force  required  to  achieve  objectives. 
Through  this  lens,  cyber  warfare  turns  from  a  potential  jus  en  bello 
detractor  to  a  highly  capable  supporter.  Cyber  weapons  hold  the 
potential  to  be  tremendously  precise  and  discriminate  in  ways  kinetic 
weapons  cannot. Additionally,  cyber  weapons  are  often  capable  of 
achieving  desired  battlefield  effects  without  the  use  of  violence. ^7 

Cyber  warfare  techniques  offer  strategists  opportunities  to  achieve 
military  objectives  with  unmatched  precision.  Some  dual-use  targets  like 
power  stations,  for  example,  may  be  targeted  in  ways  that  only  stop  the 
flow  of  electrical  current  to  circuits  used  by  military  equipment,  leaving 
civilian  energy  supplies  untouched.  An  additional  advantage  to  this 
approach  comes  at  the  cessation  of  hostilities.  Systems  that  are  degraded 
or  negated  through  cyber  warfare  are  often  not  physically  damaged.  This 
introduces  the  possibility  that  systems  can  be  turned  back  on  rather 
than  rebuilt.  When  this  method  is  compared  to  contemporary 
techniques  involving  even  the  most  precise  kinetic  weapons  like  precision 
guided  bombs,  obvious  proportionality  advantages  emerge. 

Limiting  one’s  analysis  to  a  simple  comparison  between  cyber 
capabilities  and  existing  weaponry,  however,  ignores  novel  ways  in  which 
cyber  warfare  can  improve  proportionality.  Cyber  weapons  can 
simultaneously  attack  entire  systems  like  command  and  control 
networks,  financial  enterprises,  and  military  industrial  schemes  with 
paralyzing  accuracy  while  producing  very  little  physical  collateral 
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damage.  Weapons  prepositioned  on  these  systems  ean  await  preeise 
eonditions,  instruetions,  and  leadership  approval  before  they  are  put  into 
effeet.  When  designed  properly,  these  weapons  ean  be  rendered  inert 
remotely  onee  hostilities  eease.  Unlike  landmines,  for  example,  that  litter 
historieal  battlefields  to  this  day,  eyber  weapons  offer  a  more  hygienie 
approaeh  to  warfare. 

In  eertain  instanees,  military  advantages  ean  be  ereated  through 
eyber  warfare  with  only  the  presumption  or  threat  of  an  attaek.  Low- 
level  attaeks  that  undermine  trust  in  the  fidelity  or  funetionality  of  the 
targeted  systems  may  lead  deeision-makers  to  resort  to  less  effeetive 
alternatives.  Therefore,  a  system  may  not  need  to  be  eompromised  at  all 
as  long  as  deeision  makers  ean  be  eonvineed  that  systems  are 
eompromised.  As  Thomas  Rid  states,  “Cyber-attaeks  of  all  strands,  even 
in  their  predominantly  non-violent  ways,  may  aehieve  a  goal  that 
previously  required  some  form  of  politieal  violenee:  to  undermine  the 
eolleetive  soeial  trust  in  speeifie  institutions,  systems,  organizations,  or 
individuals.  ”48 

Yet  strategists  today  must  be  eareful  to  realize  that  the  theoretieal 
possibilities  of  eyber  warfare  remain  outside  the  grasp  of  eurrent 
teehnologieal  eapabilities.  Cyber  weapons  today  are  rudimentary 
eompared  to  the  eoneeptual  uses  envisioned  by  experts  in  the  field. 4^ 
Theory  regarding  the  eapabilities  of  eyber  warfare  suggests  a  tendeney 
toward  near  perfeet  preeision.  Preeision  implies  a  finely  tuned  gauge  on 
proportionality.  Poliey  makers  who  fail  to  appreeiate  this  differenee 
between  theoretieal  and  aetual  eapabilities  are  apt  to  approve  the 
employment  of  eyber  weapons  based  on  the  promise  of  highly  seleetive 
effeets.  In  reality,  the  weapons  at  poliey  makers’  disposal  today  may  very 
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well  cause  unintended  consequences  as  discussed  earlier  in  this  section. 
Additionally,  these  weapons  may  remain  on  the  cyber  battlefield  as 
persistent  threats  for  everyone  operating  in  this  realm. 

Air  power  strategists  faced  a  similar  dilemma  during  World  War  II 
when  precision  bombing  was  touted  as  a  method  of  attacking  strategic 
vulnerabilities.  This  theoretical  premise  formed  the  basis  of  the  allies’ 
strategic  bombing  campaign  against  Germany.  Actual  aircraft 
capabilities,  aircrew  accuracy,  and  weapon  precision,  however,  limited 
the  efficacy  of  this  strategy.  Air  power  historian  Michael  Sherry, 
describing  the  US  strategy  of  precision  bombing  writes  “In  a  sense,  the 
claim  was  technically  correct,  and  [the]  men  really  believed  that  because 
American  planes  still  flew  under  directives  assigning  precise  targets, 
nothing  in  American  targeting  practices  had  changed.  But  by  the  end  of 
1944,  American  bombers  relied  on  radar  or  ‘blind  bombing’  techniques 
so  often... that  terror  became  their  inevitable  consequence...”^®  Air  power 
stood  as  a  viable  strategy  when  measured  against  its  alternatives. 
Choosing  air  power,  however,  came  at  an  ethical  cost. 

Just  as  air  power  matured  to  more  accurately  match  its 
theoretical  possibilities  with  its  practical  plausibility,  so  too  must  the 
weapons  and  practitioners  of  cyber  warfare.  A  more  granular 
understanding  of  cyber  weapons,  their  anticipated  and  unanticipated 
effects,  and  the  realm  in  which  they  operate  is  required  if  the  ethical 
standard  of  proportionality  is  to  be  maintained.  Therefore,  policy  makers 
face  a  proportionality  dilemma.  Cyber  weapons  today  may  achieve 
tremendous  effects  with  little  collateral  damage  at  relatively  low  costs, 
but  these  weapons  may  produce  unknown  effects  that  are  difficult  to 
measure.  Cyber  weapons  of  the  future  will  conceivably  become  more 
precise  and  measurable,  but  advances  in  these  weapons  require  realistic 
testing.  Until  such  time  as  technology  can  mature,  policy  makers  must 
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choose  whether  the  proportionality  risks  eyber  warfare  introduees  are 
worth  the  effeets  it  might  possibly  aehieve. 

Non-Combatant  Immunity 

Measured  proteetion  of  eivilians  is  a  mainstay  tenet  of  modern  war. 
States  and  international  institutions  have  proteeted  eivilians  from  harm 
through  established  regulations  and  norms  ranging  from  merehant 
shipping  proteetion  under  the  law  of  the  seas  to  astronaut  proteetion 
under  international  spaee  law.^i  Most  just-war  theorists  argue  from  a 
position  that  at  least  minimizes  harm  to  non-eombatants  in  war.  Walzer 
sums  up  the  popular  position,  saying  non-eombatants  are  “men  and 
women  with  rights  and  they  eannot  be  used  for  some  military  purpose, 
even  if  it  is  a  legitimate  purpose. ”^2 

While  non-eombatant  immunity  is  a  widely  aeeepted  premise  of 
war  in  the  physieal  domains,  very  little  has  been  written,  and  almost 
nothing  has  been  eodified  into  law  that  speeifieally  proteets  non- 
eombatants  in  eyberspaee.  Miehael  Sehmitt  and  the  other  eyberspaee 
experts  who  toiled  for  three  years  to  ereate  the  Tallinn  Manual  on  the 
International  Law  Applicable  to  Cyber  Warfare  eoaleseed  on  the  notion 
that  eivilians  should  not  be  direetly  targeted  with  eyber-attaeks.^^  But 
even  the  Tallinn  Manual’s  interpretation  of  existing  laws  says  a  eyber- 
attaek  is  an  operation  that  “is  reasonably  expeeted  to  eause  injury  or 
death  to  persons  or  damage  or  destruetion  to  objeets.”^"^  By  this 
definition,  eivilians  are  left  vulnerable  to  many  aets  of  eyber  warfare  that 
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can  be  disruptive,  even  devastating,  without  eausing  physieal  damage  or 
death. 

Many  plausible  eyber-attaek  seenarios  that  experts  prediet  are,  in 
faet,  aimed  direetly  at  eivilian  populations.^^  Riehard  Clarke,  eounter- 
terrorism  and  eyberseeurity  advisor  to  three  US  Presidents,  leads  a 
ehorus  of  other  influential  thinkers  who  warn  attaeks  against  eivilians 
are  imminent.  Clarke  presents  a  eompelling  ease  that  illustrates  how 
malieious  aetors  in  eyberspaee  eould  target  the  eleetrieal  grids  of  eities, 
eausing  blaekouts  that  eould  last  for  months. He  diseusses  how 
rudimentary  attaeks  against  industrial  eontrol  systems  that  manage 
water  treatment  faeilities  and  sewage  management  systems  have  already 
taken  plaee.  These  attaeks,  if  leveraged  against  key  targets  eould  affeet 
non-eombatants  en  masse. The  finaneial  seetor  is  another  area  that 
many  experts  prediet  will  fall  vietim  to  massive  eyber-attaeks.  Attaeks 
against  banking  systems  or  stoek  exehanges  that  erase,  eonfuse,  or 
enerypt  transaetion  data  on  a  massive  seale  eould  grind  national 
eommeree  to  a  standstill. These  types  of  attaeks  are  more  than 
proposed  theoretieal  eoneepts;  they  have  already  taken  plaee.  The  threat 
is  prevalent  enough  that  President  Obama  issued  an  exeeutive  order 
mandating  improved  eooperation  between  governmental  ageneies  that 
proteet  against  eyber  threats  and  the  eommereial  entities  that  eontrol 
vulnerable  eritieal  infrastrueture.^^ 

The  surfaee-level  logieal  argument  suggests  non-eombatants 
should  be  kept  immune  from  eyber  warfare  in  the  same  way  they  are 
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protected  from  traditional  warfare.  This  is  especially  true  given  the 
theoretical  propositions  that  highlight  cyber  warfare’s  ability  to  be 
enormously  selective. If  weapons  can  be  highly  discriminating,  as  the 
debate  on  proportionality  suggests,  they  should  be  used  in  the  most 
proportional  way  possible.  However,  this  comparison  assumes  the 
effects  of  cyber  weapons  are  comparable  to  those  of  traditional  kinetic 
means  of  warfare.  While  many  of  the  proposed  uses  of  cyber  warfare  can 
by  highly  disruptive  to  civilians,  most  are  either  non-violent  or  only 
facilitate  violence  indirectly. This  is  a  critical  point  of  difference 
between  the  ethics  of  cyber  warfare  and  traditional  just  war  ethical 
standards. 

It  is  useful  in  this  regard  to  think  of  cyber  warfare  in  terms  of 
Thomas  Schelling’s  concepts  of  coercion.  Schelling  described  the  United 
States’  nuclear  weapons  strategy  of  the  late  1950s  and  early  1960s  as 
one  that  directly  targeted  civilians.  The  reasons  for  this  choice  were 
twofold.  First,  nuclear  war  demonstrated  the  limits  of  total  war  where 
combat  was  no  longer  constrained  to  engagements  between  fielded 
military  forces.  Rather,  entire  countries  and  their  civilians  were  targeted 
for  annihilation. Second,  the  coercive  psychological  effect  of  knowing 
one’s  populous  was  targeted  for  nuclear  extinction  was  a  powerful  force 
in  the  decision-making  processes  of  both  sides  of  a  potential  nuclear 
exchange. Schelling  wrote,  “We  live  in  an  era  of  dirty  war.”^"^  Context, 
however,  is  critically  important  when  comparing  cyber  warfare  to  nuclear 
warfare. 

When  violence  is  removed  from  the  equation,  or  at  least  removed 
as  it  pertains  to  nuclear  war,  the  concept  of  coercion  takes  new  shape. 
Schelling  writes  “Military  strategy  can  no  longer  be  thought  of,  as  it  could 
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for  some  countries  in  some  eras,  as  the  science  of  military  victory.  It  is 
now  equally,  if  not  more,  the  art  of  coercion,  of  intimidation,  and 
deterrence. Cyber  warfare  options  that  target  electrical  grids  or 
financial  systems  may  prove  both  coercive  and  non-violent.  In  the 
ethical  decision-making  hierarchy,  where  prima-facie  duties  take 
precedent,  non-lethal  cyber  means  of  achieving  desired  effects  may 
actually  be  preferred,  even  if  they  target  civilians  instead  of  military 
forces. 

This  counterintuitive  strategy  is  reinforced  by  the  possibility  that 
cyber-attacks  can  be  designed  in  ways  that  make  them  reversible. 

Attacks  on  electrical  grids,  for  example,  seize  control  of  key  components 
rather  than  destroying  the  controls  themselves.  Attacks  against  financial 
centers  can  be  designed  in  ways  that  encrypt  key  data,  allowing 
attackers  to  maintain  the  logical  keys  that  restore  the  systems  to  their 
previous  state  once  demands  are  met.^”^  This  aspect  of  cyber  warfare 
adds  another  layer  of  action  to  Schelling’s  lessons.  Schelling’s  coercion 
and  deterrence  theories  are  what  he  calls  “skillful  nonuse  of  military 
forces. It  is  conceivable  in  the  scenarios  mentioned  above  that 
coercion  or  deterrence  may  continue  even  after  an  actor  launches  cyber 
strikes. 

Another  dimension  of  non-combatant  immunity  that  must  be 
considered  is  whether  states  have  the  responsibility  to  protect  their 
citizens  from  acts  of  cyber  warfare.  This  is  particularly  poignant  if 
scenarios  exist  where  non-combatants  can  be  targeted  ethically  as 
suggested  above.  Hobbes  asserts  the  very  reason  states  exist  is  to  offer 
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protection  to  their  citizens. Locke  tempers  Hobbes’  staunch  realism 
but  still  contends  man  surrenders  obedience  to  a  society  in  exchange  for 
privileges  and  protection. If  cyber  warfare  is  just  another  threat 
against  a  country  and  its  citizens,  it  would  stand  to  reason  that  a 
country  would  have  the  responsibility  to  protect  its  citizens  from  known 
cyber  threats. 

Vulnerabilities  in  cyberspace  as  they  exist  today,  however, 
complicate  the  responsibilities  of  the  state.  Most  commercial  companies 
that  produce  cyberspace’s  hardware  and  software  foundation  operate 
internationally.'^!  Therefore,  vulnerabilities  in  these  platforms  are  shared 
by  all  people  who  operate  on  similar  systems,  regardless  of  nationality. 
The  companies  that  manage  and  maintain  these  systems  are  incentivized 
to  fix  vulnerabilities  once  they  are  discovered  and  made  public  in  order  to 
guarantee  the  image  and  integrity  of  their  products.  Yet  actors  who  wish 
to  operate  offensively  in  cyberspace  often  rely  on  undiscovered 
vulnerabilities  to  gain  access  to  target  systems. 

This  conundrum  places  states  in  a  difficult  dilemma.  On  one 
hand,  states  must  protect  their  citizens.  Citizens  would  be  best  protected 
if  states  acknowledge  vulnerabilities  when  they  are  discovered  so  that 
domestic  instances  of  these  flaws  can  be  corrected  by  the  globally-based 
commercial  entities  that  create  and  maintain  cyber  systems.  On  the 
other  hand,  however,  states  are  tempted  to  preserve  secret  information 
about  undetected  vulnerabilities  so  that  these  system  weaknesses  can  be 
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used  as  access  points  for  their  own  cyber  weapons.  Many  actors  in 
cyberspace  actually  pay  substantial  amounts  of  money  for  vulnerabilities 
known  as  zero  day  exploits  that  have  been  discovered  but  not  yet 
corrected. Actors  in  cyberspace,  therefore,  must  decide  whether  the 
harm  these  vulnerabilities  present  to  peaceful  citizens  is  worth  the  price 
to  ensure  vulnerabilities  are  kept  available  for  exploitation. 

This  scenario  also  highlights  a  source  of  conflict  between 
commercial  software  and  hardware  companies,  and  the  populations  they 
service.  If  populations  become  dependent  upon  cyberspace  for  basic 
functions  like  banking,  communication,  and  emergency  services,  a 
state’s  responsibility  to  protect  cyberspace  increases.  As  states  find  that 
more  of  their  critical  infrastructure  like  railway  control  systems,  gas  line 
valves,  and  electricity  routing  systems  are  connected  to  cyberspace,  the 
responsibilities  only  increase  further. Commercial  companies  that  are 
worried  about  maintaining  adequate  profit  margins  will  compel  states  to 
assume  as  much  of  the  responsibility  for  repairing  vulnerabilities  as  they 
can."^^  This  tension  led  President  Obama  to  issue  an  executive  order  in 
February,  2013  detailing  unprecedented  cooperation  and  responsibility 
sharing  relationships  between  commercial  entities  that  manage 
cyberspace  and  the  government  agencies  charged  to  protect  people  from 
cyber-attacks.'^^  Powerful  actors  like  the  United  States  will  increasingly 
find  it  necessary  to  cooperate  with  relatively  lesser  political  actors  and 
commercial  entities  in  order  to  preserve  order  in  cyberspace.'^'^ 

Here  again,  however,  the  blurred  line  between  combatants  and 
non-combatants  in  cyberspace  complicates  efforts  to  draw  ethical 
demarcation  lines.  Through  cyberspace,  civilians  have  another  avenue 
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they  can  use  to  support  their  states’  war  efforts  with  very  little 
involvement  in  actual  combat.  Non-combatants  who  possess  home 
computing  resources,  for  instance,  may  allow  their  governments  to 
leverage  their  systems  for  the  cyber  warfare  activities  of  the  state. 

Citizens  may  simply  allow  a  voluntary  form  of  botnet  control  software  to 
be  installed  on  their  computers  so  that  network  bandwidth  and  computer 
processing  power  can  be  pooled  for  coordinated  attacks.  This  approach 
is  not  without  precedent.  Russian  computers  launched  attacks  against 
websites  in  Estonia  and  Georgia  in  2008  ahead  of  Russian  military 
advances.  A  website  called  StopGeorgia  provided  a  software  utility 
dubbed  DoSHTTP  that  allowed  average  citizens  to  choose  target  websites 
and  click  a  button  labeled  “Start  Flood.”  This  action  sent  barrages  of 
data  toward  targeted  sites  in  coordinated  denial  of  service  attacks. 

Like  the  factory  workers  of  World  War  11  who  produced  aircraft  and 
tanks  to  bolster  war  efforts,  or  citizens  who  purchased  war  bonds  to  fund 
military  forces,  citizens  who  augment  cyber  warfare  activities  share  some 
responsibility  for  their  actions.  Should  these  near-combatants  be 
considered  somewhere  on  the  spectrum  between  warring  soldiers  and 
peaceful,  innocent  civilians?'^^  Walzer  suggests  counter-attacks  against 
these  cyber  augmenters  are  only  justified  if  the  attackers  present  such  a 
risk  that  they  warrant  action  due  to  military  necessity.  This  was  the 
same  verdict  levied  on  the  German  U-boat  crew  that  targeted  the 
Laconia,  a  merchant  vessel,  in  1942.®°  Citizens  engaged  in  cyber 
warfare,  however,  may  be  targeted  with  commensurate  cyber  weapons 
instead  of  physical  responses.  When  violence  is  removed  and  effects  are 
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certainly  entertained  this  notion  as  described  in  this  text,  cyberspace  allows  people  to  become  passive 
participants  in  conflicts  in  ways  physical  domains  do  not.  This  changing  context  and  associated 
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measured  in  damage  to  equipment  and  resourees,  the  eoneept  of  military 
neeessity  takes  new  form.  This  topie  will  be  explored  further  as  it 
pertains  to  the  ethieal  premise  of  last  resort. 

Non-eombatant  immunity  seems  as  if  it  should  be  an 
uneompromising  standard  for  warfighters.  Yet  the  intrieaeies  of  eyber 
warfare  ereate  eause  to  question  the  fundamental  aspeets  of  ethieal 
warfare  as  they  exist  today.  Certainly,  non-eombatants  should  enjoy  a 
measure  of  proteetion  from  harm,  espeeially  eompared  to  their  war¬ 
making  eounterparts.  Where  lethal  options  are  all  that  remain  against 
potential  adversaries,  however,  one  must  eonsider  whether  non-lethal 
eyber  strikes  against  eivilians  are  more  ethieally  justifiable.  These 
deeisions  are  further  eomplieated  as  the  threshold  for  eitizens  to  engage 
themselves  in  state  eyber  warfare  aetivities  is  eontinually  lowered  by 
teehnology.  Cyber  warfare  not  only  ehanges  the  battlefield,  it  alters  how, 
when,  and  where  fighting  oeeurs.  These  faetors  must  be  eonsidered  as 
strategists  attempt  to  maintain  an  ethieal  advantage  in  eyberspaee. 

Last  Resort 

Miehael  Walzer  eoneludes  Just  and  Unjust  Wars  with  a  grim 
aeknowledgement  that  man  has  yet  to  free  himself  from  the  trappings  of 
war.  Walzer  writes  “And  yet  [war]  eannot  be  eseaped,  short  of  a  universal 
order  in  whieh  the  existenee  of  nations  and  peoples  eould  never  be 
threatened.  There  is  every  reason  to  work  for  sueh  an  order.  The 
diffieulty  is  that  we  sometimes  have  no  ehoiee  but  to  fight  for  it.”®^  The 
premise  of  last  resort  is  the  final  arbiter  of  jus  ad  bellum,  eompelling 
potential  eombatants  to  wait  until  they  have  no  ehoiee  but  to  resort  to 
war.  Last  resort  rests  on  the  idea  that  fighting,  as  Walzer  so  eloquently 
deseribed,  should  not  oeeur  until  all  other  feasible  options  have  been, 
argued,  eonsidered,  and  tried.  Given  the  prima-facie  responsibility  to 
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prioritize  protection  of  life  ahead  of  any  type  of  conquest,  it  makes  good 
ethical  sense  to  reserve  warfare  until  absolutely  necessary. 

Cyber  warfare,  however,  does  not  easily  wedge  into  the  time-tested 
parameters  of  last  resort.  With  prima-facie  responsibilities  as  last  resort’s 
grounding  principles,  one  must  consider  whether  non-lethal  actions  in 
cyberspace  break  the  threshold  by  which  last  resort  is  measured. 
Certainly,  cyber-attacks  that  produce  lethal  effects,  such  as  catastrophic 
flooding  that  could  directly  resort  from  an  attack  on  a  dam’s  control 
systems,  should  be  treated  just  as  any  other  act  of  warfare. phe 
resort  premise  in  cyber  warfare  aligns  nicely  when  lives  are  threatened. 
What  about  the  larger  portion  of  the  theoretical  cyber  warfare  spectrum 
that  does  not  directly  produce  casualties?  Should  actions  like  those 
observed  in  the  Stuxnet  attack,  for  instance,  be  restrained  in  the  same 
way  as  kinetic  warfare?  Should  non-lethal  attacks  even  be  considered 
acts  of  war?  These  are  the  questions  the  remainder  of  this  section  will 
address. 

The  Tallinn  Manual  intentionally  creates  distinction  between  the 
terms  cyber-attack  and  cyber  operations.  Cyber  operations,  the  manual 
says,  describe  “The  employment  of  cyber  capabilities  with  the  primary 
purpose  of  achieving  objectives  in  or  by  the  use  of  cyberspace.”^'^  A 
cyber-attack  is  a  “cyber  operation,  whether  offensive  or  defensive,  that  is 
reasonably  expected  to  cause  injury  or  death  to  persons  or  damage  or 
destruction  to  objects. The  members  of  Tallinn’s  International  Group 
of  Experts  agreed  that  cyber  operations  that  do  not  rise  to  the  level  of 
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cyber-attacks  should  still  comply  with  international  laws,  including  the 
law  of  armed  conflict. 

This  distinction  draws  out  the  important  idea  that  cyber  warfare, 
defined  in  this  study  as  actions  by  state  or  non- state  actors  that  exploit 
an  adversary’s  information  systems  in  order  to  further  political 
objectives,  can  be  either  lethal  or  non-lethal.  Additionally,  some  non- 
lethal  cyber  operations  can  produce  effects  similar  to  those  of  kinetic 
strikes  without  causing  permanent  damage. A  strategist  who 
approaches  cyber  warfare  looking  for  a  clear  delineation  between  peace 
and  war  in  the  traditional  sense  will  certainly  be  disappointed. 

The  last  resort  in  cyber  warfare  cannot  be  addressed  in  an  abstract 
set  of  rules  or  tripwires.  Each  instance  and  decision  where  cyber  warfare 
may  be  justifiably  employed  depends  heavily  on  its  context. Instead,  it 
is  helpful  to  place  the  range  of  cyber  operations  that  can  be  used  as  acts 
of  cyber  warfare  on  a  spectrum  along  traditional  jus  ad  bellum  and 
cassus  beZZi  considerations.^^  See  figure  1  below. Relative  peace,  where 
any  act  of  war  would  be  deemed  aggressive  in  nature,  lies  on  one  end  of 
the  spectrum.  On  the  other  is  total  war,  where  ethical  considerations  are 
secondary  to  existential  threats.  When  disagreements  arise, 
international  norms  and  laws  establish  guiding  principles  for  the  use  of 
enforcement  mechanisms  short  of  war.  Conflicts  that  escalate  to 
untenable  levels  are  examined  within  existing  international  legal  and 
ethical  frameworks  before  the  use  of  force  is  authorized.  Generally 
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Figure  1  was  created  by  this  author  to  clarify  the  way  in  which  cyber  capabilities  potentially  lower  the 
threshold  for  acceptable  preemptive,  preventative,  and  putative  actions 
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speaking,  this  process  occurs  under  Articles  42  and  51  of  the  United 
Nations  Security  Council.  These  articles  permit  the  use  of  force  when 
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Figure  1:  Spectrum  of  Conflict  and  Cassus  Belli  (Author’s  original  work) 


the  Security  Council  votes  to  authorize  such  activity  or  when  states  must 
fight  in  self-defense. Cyber  warfare,  however,  overlaps  existing  options 
that  change  a  conflict’s  decision  calculus.  Non-lethal  cyber  warfare 
options  may  conceivably  be  justified  before  more  traditional  forms  of  war 
if  they  help  de-escalate  a  conflict  or  negate  threats  from  aggressive 
adversaries. As  conflicts  tilt  further  toward  war,  some  cyber  warfare 
scenarios,  particularly  those  deemed  cyber-attacks  by  the  Tallinn 
Manual  definition,  may  be  met  with  more  traditional,  lethal  responses. 
Relatively  small  harassing  attacks  may  also  accumulate  to  damaging 
levels  that  justify  kinetic  or  cyber  retaliation.^"^  David  Gewirtz,  an 
international  cyber  security  and  antiterrorism  expert,  illustrated  this 
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concept  through  the  example  of  industrial  attaeks.  Gerwirtz  said,  “When 
there  are  eonstant,  advaneed,  persistent  attaeks  targeting  Ameriea’s 
energy  grid,  and  when  some  of  them  make  it  through  to  the  point  of 
keeping  at  least  one  power  plant  offline  for  weeks,  that’s  no  longer  just 
eyberwar,  that’s  war.”^^ 

A  fundamental  assumption  in  this  diseussion  is  that  attribution 
ean  be  established.  A  known  diffieulty  in  eyberspaee  diseussed  earlier, 
attribution  is  essential  to  any  justified  response.  Without  elear  evidenee 
that  identifies  the  perpetrator  of  an  attaek  or  imminent  threat,  one  may 
inadvertently  target  the  wrong  party. When  attaeks  ean  be  direetly 
attributed  to  a  state,  justified  responses  are  easier  to  ereate  and  endorse. 
When  eyber  warfare  aetions  emanate  from  within  a  state,  but  no  elear 
ties  to  government  ean  be  established,  response  aetions  not  only  must 
assume  attribution,  they  must  assume  states  are  responsible  for  the 
aetions  of  their  eitizens.^”^  While  these  are  fundamental  aspeets  of  ethieal 
warfare,  they  are  partieularly  poignant  in  eyberspaee  where  anonymity  is 
simple  to  aehieve,  and  innoeent  parties  are  often  wrongfully  implieated.^^ 
With  this  framework  in  mind,  the  foeus  turns  to  a  more  refined 
examination  of  offensive  and  defensive  aetions  that  fall  within  the  last 
resort  grey  area  eyber  warfare  ereates.  Offensive  aetions  that  produee 
eyber  effeets  without  eausing  physieal  damage  or  loss  of  life,  for  instanee, 
may  be  aeeeptable  under  existing  international  law.^^  Mierosoft’s  Aetive 
Response  for  Seeurity,  dubbed  Project  MARS,  serves  as  a  ease  in  point. 
Aeeording  to  Mierosoft,  Project  MARS  “is  foeused  on  eombining  legal  and 
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technical  acumen  to  proactively  disrupt  criminal  infrastructure.  This 
includes  taking  down  botnets... seizing  the  infrastructure  and  domains 
criminals  use  to  control  them  and  taking  the  information  we  gain  in 
those  efforts  to  help  better  protect  the  Internet  community  and  our 
customers.”i°°  This  effort  is  geared  primarily  toward  protection  against 
economic  threats  but  the  same  concept  could  apply  to  anticipatory  state 
efforts  against  threats  below  the  threshold  for  cyber-attacks.  While  these 
actions  may  appear  offensive,  their  goal  is  one  of  defense  and  protection 
against  ongoing,  persistent,  detrimental  cyber  operations. 

Offensive  cyber  warfare  actions  outside  the  legal  framework  for 
cassus  belli  are  likely  to  be  judged  based  on  estimates  of  the  opposing 
threat’s  severity  and  imminence.  Much  like  the  case  for  preventative  or 
preemptive  actions  in  a  more  traditional  sense,  the  onus  is  on  the 
perpetrator  of  offensive  cyber  warfare  actions  to  prove  offensive  actions 
were  justified.  Some  experts  argue  that  the  unique  capabilities  cyber 
warfare  introduces  may  allow  conflicts  to  be  diffused  before  they  rise  to 
the  level  of  war.^^i  Stuxnet,  for  example,  is  credited  with  at  least 
delaying  war  between  Iran  and  its  adversaries  by  setting  back  Iran’s 
nuclear  enrichment  program.  However,  others  will  argue  that  small- 
scale  offensive  cyber  actions  can  quickly  escalate  in  unforeseen  ways 
that  actually  lead  more  quickly  to  war.^^^  others  will  argue  that 
small  planning  and  preparatory  incursions  into  adversary  weapons 
systems  are  necessary  in  order  to  prepare  the  cyber-battlefield  for 
possible  conflicts.  While  opponents  would  view  these  activities  as 
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unnecessary  and  unethical  subversion,  proponents  view  these 
preemptive  steps  as  prudent  planningd^^ 

While  the  fundamental  motivations  and  processes  behind  the  last 
resort  premise  remain  sound  when  applied  to  cyber  warfare, 
implementation  of  these  concepts  requires  intellectual,  political,  and 
technical  savvy.  Aggressive  action  is  universally  bemoaned  by  scholars 
of  ethics  in  cyberspace  as  it  is  in  any  other  medium.  That  said,  the 
distinction  between  aggression,  active  defense,  and  meticulous 
preparation  is  blurred  by  the  spectrum  of  effective  lethal  and  non-lethal 
activities  cyber  warfare  introduces.  The  last  resort  premise  is  still  vital  to 
the  sanctity  of  prima-facie  responsibilities,  but  instances  exist,  whether 
they  are  deemed  war  or  some  action  short  of  war,  where  cyber  warfare 
techniques  may  be  judiciously  employed  before  other  more  traditional 
forms  of  war. 


Sovereignty 

One  final  concept  that  deserves  a  fresh  look  in  this  examination  of 
cyberspace  and  cyber  warfare  is  sovereignty.  Cyberspace  continues  to 
rapidly  expand  around  the  globe  in  new  and  unexpected  ways. 
Transoceanic  cables  connect  the  world’s  land  masses,  allowing  enormous 
amounts  of  data  to  transit  between  connected  nodes  literally  at  the  speed 
of  light  with  little  regard  for  physical  distances  or  borders^®^.  Satellites 
in  orbit  allow  anyone  with  a  credit  card  and  an  antenna  to  establish 
private,  unregulated  connections  to  cyberspace  regardless  of  where  they 
are  on  Earth.  To  illustrate  how  cyberspace  has  changed  the  world. 


David  E.  Graham,  "Cyber  Threats  and  the  Law  of  War,"  Journal  of  National  Security  Law  &  Policy  4 
(2010):  10. 

How-to  Geek,  Interactive  Cable  Map  Showcases  High  Speed  Undersea  Cables  Around  the  World, 
accessed  7  Jun  2014,  http://www.howtogeek.com/95711/interactive-cable-map-showcases-high-speed- 
undersea-cables-around-the-world/ 

Miniature,  personal  satellites  antennas  are  common  in  many  remote  regions.  While  equipment  and 
service  costs  are  barriers  to  many,  the  technology  is  maturing  and  prices  are  falling.  For  one  example  of 
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imagine  an  American  citizen  boarding  a  plane  bound  for  Seoul,  South 
Korea  with  no  passport  or  other  documentation  other  than  his  name  and 
place  of  origin.  When  he  arrives  in  Korea  he  transitions  to  a  waiting 
helicopter  that  flies  to  a  shop  in  Beijing,  China  and  lands.  The  man  then 
enters  the  shop,  buys  a  toy  for  his  child  using  American  dollars,  and 
returns  to  the  United  States  via  the  same  route.  As  we  know,  this  type  of 
transaction  occurs  millions  of  times  every  day  in  the  global  marketplace 
facilitated  by  cyberspace  without  the  complexities  of  distance  or 
international  borders.  Even  if  the  countries  involved  were  to  acquiesce 
and  allow  these  types  of  legitimate,  yet  intervening,  transactions  to  occur 
in  the  physical  world  as  they  do  in  cyberspace,  we  must  accept  the  fact 
that  acts  of  cyber  warfare  occur  with  the  same  disregard  for  established 
borders. 

Some  countries  have  been  marginally  successful  at  limiting  the 
types  and  sources  of  content  that  enter  and  exit  their  physical  borders 
via  cyberspace  through  the  use  of  carefully  engineered  networks. 

China’s  “great  firewall”  is  the  most  well-known  example  of  such  a 
configuration.  All  known  connections  to  the  global  Internet  are  filtered  at 
China’s  borders  to  cyberspace.  Many  of  the  world’s  most  visited  websites 
are  blocked  or  substituted  with  alternatives  that  are  approved  by  the 
Chinese  government.  However,  influential  commercial  entities  like 
Google  have  shown  some  leverage  in  convincing  oppressive  governments 
to  relax  their  filtering  practices  in  exchange  for  their  business. Users 
have  also  found  ways  to  circumvent  even  the  most  advanced  filtering 
systems  through  the  use  of  sophisticated  anonymity  and  encryption 

methods  that  can  be  used  to  access  the  Internet  from  anywhere  on  earth,  see 
http://www.groundcontrol.eom/one-touch-flyaway_001.htm 

On  May  1,  2013  multiple  sources  in  the  U.S.  media  reported  that  actors  in  China  carried  out  cyber¬ 
attacks  targeting  the  US  Army  Corps  of  Engineers'  databases  containing  sensitive  details  about  America's 
hydro-electric  damns.  See  http://freebeacon.com/the-cyber-dam-breaks/  for  one  example  of  a  report. 

See  www.greatfirewallofchina.org  for  an  interactive  search  of  websites  and  resources  that  are  blocked 
in  China 

Rebecca  MacKinnon,  Consent  of  the  Networked:  The  Worldwide  Struggle  for  Internet  Freedom  (New 
York:  Basic  Books,  2012),  36-37. 
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tools. The  Internet  was  not  built  with  international  borders  in  mind 
and  almost  all  attempts  to  mold  eyberspaee  into  adherenee  with  existing 
physieal  boundaries  have  resulted  in  porous  eyber-borders  at  best. 

When  eombined  with  the  speed  and  relative  anonymity  inherent  in 
movements  through  eyberspaee,  sovereignty  beeomes  a  eoneept  of  very 
little  eonsequenee  and  one  that  is  even  less  enforeeable  in  the  eyber 
realm. 

The  eore  eoneepts  of  Westphalian  sovereignty,  however,  still  form 
the  foundation  of  international  relations.  While  it  is  helpful  to  eonsider 
eyberspaee  as  a  unique  domain,  one  should  eaution  against  the 
temptation  to  treat  eyberspaee  in  isolation  from  other  existing  power 
struetures.  The  array  of  eleetronie  deviees  that  form  the  strueture  of  the 
domain  ean  be  ehanged  and  manipulated  to  fit  existing  international 
struetures.  While  many  nations  and  international  institutions,  ineluding 
the  United  States,  have  beeome  inereasingly  dependent  upon  eyberspaee 
for  government,  eeonomie,  and  military  funetions,  the  domain  itself 
eontinues  to  expand  globally.  The  very  strategies  nations  ereate  to 
govern,  expand,  utilize,  and  deny  eyberspaee  to  others  aetually  shape  the 
domain.  This  seenario  presents  an  ironie  eonneetion  between  eyberspaee 
and  the  physieal  world.  The  eyberspaee  environment  allows  people  to 
eonneet  in  ways  that  were  previously  impossible.  This  tends  to  erode  the 
importanee  of  international  borders  and  state  power.  At  the  same  time, 
however,  the  way  states  approaeh  eyberspaee  aetual  influenees  the 
strength  and  reaeh  of  the  domain  itself. 

The  aforementioned  seenario  ereates  tension  between  eyberspaee 
and  existing  power  struetures.  Some  leaders  view  eyberspaee  as  a 
weleome  foree  for  openness  and  prosperity,  as  in  the  ease  of  the  ITU’s 


The  Wall  Street  Journal:  "No  VPN?  No  Problem.  A  New  Way  Around  China's  Great  Firewall," 
November,  2012.  http://blogs.wsj.com/chinarealtime/2012/ll/29/no-vpn-no-problem-a-new-way- 
around-chinas-great-firewall/ 
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push  to  expand  broadband  connectivity  for  global  prosperityd^i  Others, 
however,  see  cyberspace  as  a  threat  that  undermines  legitimate  forms  of 
government,  as  the  recent  case  of  the  Turkish  Prime  Minister’s  ban  on 
YouTube  and  Twitter  demonstrates d  12  This  tension  makes  cyberspace  a 
dynamic  environment.  As  virtual  services,  capabilities,  and  connections 
ebb  and  flow  based  on  governmental  policies  they  reshape  the  map  of 
cyberspace.  All  the  while,  however,  the  physical  map  which  contains 
national  borders  and  traditional  understanding  of  sovereignty  serves  as  a 
guiding  baseline  for  cyberspace’s  development. 

The  question  becomes  one  of  state  responsibilities  for  cyberspace. 

Is  a  state  responsible  for  the  legitimate  and  illegitimate  actions  that 
originate  from  within  a  state’s  borders?  At  first  pass,  it  seems  logical  to 
levy  this  duty  on  states  in  the  same  way  nations  are  accountable  for 
anything  else  that  emanates  from  their  borders.  Aircraft  that  leave  one 
state  to  bomb  another  are  certainly  the  responsibility  of  the  originating 
location.  Even  radio  waves  that  start  in  one  state  and  affect  the 
spectrum  in  another  nation  must  be  controlled  by  their  originators. 

The  Tallinn  Manual  suggests  states  are  not  only  responsible  for  the 
systems,  cables,  and  routing  systems  inside  their  borders,  they  are  also 
responsible  for  their  assets  held  in  international  waters  and  in  space. 

On  the  other  side  of  the  argument,  however,  one  finds  equally 
convincing  evidence  suggesting  states’  responsibilities  for  their  physical 
and  virtual  corners  of  cyberspace  only  go  so  far.  The  attribution  problem 
discussed  at  length  in  other  sections  of  this  essay  makes  it  difficult  for 
states  to  conclusively  pinpoint  sources  of  threatening  cyber  activity 
emanating  from  within  their  borders.  Additionally,  the  distributed 

Kagame  and  Helu,  Transformative  Solutions  for  2015  and  Beyond:  Manifesto. 

"Turkey  Blocks  YouTube  as  Audio  of  High-Level  Meeting  on  Syria  Leaks,"  The  Lede,  accessed  April  11, 
2014,  http://thelede.blogs.nytimes.eom/2014/03/27/turkey-follows-twitter-ban-with-block-on-youtube- 
as-audio-of-high-level-meeting-on-syria-leaks/. 

ITU-R,  "Rules  of  Procedure,"  ITU,  accessed  April  11,  2014,  https://www.itu.int/pub/R-REG-ROP-2012. 

NATO  Cooperative  Cyber  Defence  Centre  of  Excellence,  Tallinn  Manual  on  the  International  Law 
Applicable  to  Cyber  Warfare,  2013,  23,  26. 
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architecture  of  cyberspace  control,  where  no  one  nation  retains  the 
ability  to  shape  the  environment  in  its  entirety,  leaves  states  with  only 
limited  capabilities  to  hinder  some  types  of  activities  should  they  decide 
to  do  sod  The  cyberspace  is  so  vast  and  ever-changing  that  the  most 
technically-proficient  nations  cannot  feasibly  be  expected  to  defend 
against  or  limit  the  plethora  of  threats  that  exist,  Therefore,  it  is 
difficult  to  hold  states  accountable  for  something  they  cannot  control. 

The  complicated  relationship  between  commercial  entities  and 
governments  further  complicates  the  sovereignty  debate  in  cyberspace. 
The  United  States  government,  for  example,  has  found  itself  reliant  upon 
commercial  cyberspace  service  providers  and  critical  infrastructure 
systems.  This  reliance  is  so  strong  that  normal  societal  functions  like 
utility  services  and  transportation  management  could  be  severely 
impacted  if  the  commercial  systems  cease  to  operate  as  they  should. 
Nations  now  must  decide  how  much  authority  they  have  to  impinge  on 
the  commercial  viability  and  profitability  of  these  providers  by  forcing 
them  to  implement  expensive  security  and  functionality  safeguards.  The 
United  States  is  working  through  this  exact  scenario  now.  President 
Obama’s  Cyberspace  February,  2013  Executive  Order  detailing 
requirements  for  critical  infrastructure  protection  serves  as  case  in 
point. 

When  threats  emanate  from  within  a  nation’s  borders  and  the 
government  of  that  nation  is  hampered  by  the  limitations  noted  above, 
one  must  consider  whether  third  parties  -  other  nations,  commercial 
entities,  and  non-state  actors  -  have  the  right  to  intervene  to  quell 
threats.  Certainly,  all  of  the  jus  ad  bellum  and  jus  en  bello  considerations 
addressed  thus  far  would  still  apply.  If  these  criteria  are  met,  however, 

Kim  G.  Von  Arx  and  Gregory  R.  Hagen,  "Sovereign  Domains:  A  Declaration  of  Independence  of  ccTLDs 
from  Foreign  Control,"  Rich.  JL  &  Tech.  9  (2002):  4-8. 

Brent  Williams,  "Ten  Propositions  Regarding  Cyberspace  Operations,"  Joint  Forces  Quarterly,  no.  61 
(Quarter  2011):  10-17. 

"Executive  Order  -  Improving  Critical  Infrastructure  Cybersecurity  |  The  White  House." 
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the  question  remains  whether  a  nation  has  the  right  to  do  as  Mierosoft 
has  done  with  Projeet  MARS  in  terms  of  sovereigntyd^^  In  the  more 
traditional  definition  of  sovereignty,  the  entire  notion  of  ethieal 
intervention  suggests  nations  are  only  entitled  to  the  benefits  their 
borders  provide  so  long  as  they  are  capable  of  managing  their  domestic 
affairs One  could  certainly  imagine  scenarios  where  a  nation  would 
decide  to  virtually  intervene  to  stymie  cyber  threats  or  cyber-attacks  from 
within  another  nation’s  borders. 

Culmination 

The  ethical  considerations  explored  here  are  only  a  subset  of  those 
facing  national  decision-makers,  security  practitioners,  and  strategists  at 
all  levels.  The  world  is  watching.  As  powerful  actors  continue  to  move 
more  effort  toward  cyberspace  and  the  capabilities  facilitated  through 
this  domain,  norms  of  behavior  will  continue  to  develop.  The  United 
States  is  in  a  unique  position  of  both  great  power  and  great  vulnerability 
in  cyberspace.  American  ability  to  project  power  in  cyberspace  is 
tempered  to  a  great  degree  by  corresponding  vulnerabilities.  With 
technological  and  physical  safeguards  against  these  weaknesses  mired  in 
political  and  technical  difficulties,  norms  of  acceptable  behavior  become 
defacto  defense.  US  Secretary  of  Defense,  Chuck  Hagel,  presented  a 
speech  at  the  headquarters  of  United  States  Cyber  Command  in  March, 
2014  in  which  he  said  the  United  States  would  “maintain  an  approach  of 
restraint  to  any  cyber  operations  outside  of  U.S.  government  networks.” 
Hagel  added,  “We  are  urging  other  nations  to  do  the  same. As  the 
world  struggles  to  develop  appropriate  guidelines  for  cyberspace  and 


Microsoft,  "Malicious  Software  Crimes,"  Microsoft  in  Public  Safety  &  National  Security,  accessed  April 
10,  2014,  http://www.microsoft.com/government/ww/safety-defense/initiatives/Pages/dcu-economic- 
crime.aspx. 

Hoizgrefe  and  Keohane,  Humanitarian  Intervention,  25. 

Helene  Cooper,  "Hagel  Seeks  Peace  Pact  for  Digital  Realm,"  The  New  York  Times,  March  28,  2014, 
http://www.nytimes.com/2014/03/29/us/politics/hagel-seeks-peace-pact-for-the-digital-realm.html. 
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cyber  warfare,  these  words  must  be  matehed  with  aetions  that  build  on 
ethieal  framework  this  doeument  moves  forward. 
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Chapter  4 

Theory,  Strategy,  and  Reality 


Technology  helps  change  civilizations.  New  innovations  are  grafted 
into  societies  by  innovators  who  tout  improvement  and  advancement. 

The  same  advances  that  make  life  easier,  faster,  clearer,  and  simpler, 
however,  often  have  military  utility,  ushering  in  commensurate  changes 
in  the  ways  people  fight  wars.  Cyberspace  most  certainly  fits  this  dual- 
edged  description.  Global  harmony  and  synchronization  are  made 
possible  by  the  light-speed  communication  and  collaboration  capabilities 
cyberspace  provides.  Simultaneously,  however,  cyberspace  offers  the 
ability  to  put  crosshairs  on  previously-immune  targets  in  novel  ways 
through  cyber  warfare.  As  these  capabilities  emerge,  responsible  actors 
will  not  simply  ask  if  an  action  can  be  done;  they  will  ask  if  it  should  be 
done.  The  arguments  presented  in  the  first  three  chapters  of  this  paper 
confront  some  of  the  questions  at  the  heart  of  this  ethical  debate. 

This  chapter  presents  a  hypothetical  scenario  that  builds  upon 
actual  tension  that  exists  in  the  world  today.  In  1930,  as  air  power  was 
coming  into  its  own  as  a  force  for  good  and  a  force  for  war,  Giulio  Douhet 
undertook  a  similar  exercise  in  his  essay.  The  War  of  1 9—.  ^  Douhet  was 
solicited  by  Rivista  Aeronautica  to  contemplate  how  the  emerging 
capabilities  of  air  power  would  weave  into  future  wars.  His  thoughts  on 
this  challenge  resonate  with  the  task  at  hand: 

I  have  to  confess  that  the  invitation  extended  to  me  by  the 
editor  of  this  review  greatly  pleased  me,  and  1  accepted  it  at  once, 
but  perhaps  thoughtlessly,  as  1  realized  as  soon  as  1  began  to 
consider  the  task  1  had  undertaken. 

The  subject  was  to  be  a  description  of  a  hypothetical 
conflict  among  the  great  powers  in  the  near  future.  A  difficult 
subject  in  any  case,  and  more  so  when  1  considered  that  it  was  not 


^  Giulio  Douhet,  The  Command  of  the  Air,  Fire  Ant  Books  (Tuscaloosa,  AL:  University  of  Alabama  Press, 
1998),  299-394. 
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a  question  of  idle  imaginings  or  flights  of  faney.  Rather,  I  must 
submit  to  the  tight  rein  of  logie  and  the  strait  jaeket  of  reason, 
sinee  I  was  to  write  a  serious  work  for  a  reputable  military  review, 
and  1  had  to  aehieve  the  praetieal  end  of  teaehing  something  to  the 
present  by  means  of  imagined  happenings  in  the  near  future.  If  1 
had  not  given  the  editor  my  formal  aeeeptanee,  and,  what  was 
worse,  if  the  review  had  not  published  an  announeement  of  the 
fortheoming  work,  1  should  gladly  have  given  up  the  task.  But 
there  was  no  way  out,  and  1  had  to  go  on. 2 


While  Douhet’s  prophesy  was  ultimately  judged  by  many  to  be  an  overly 
fervent  predietion  of  air  power’s  deeisiveness  in  war,  his  words  deseribing 
the  ehallenge  of  teehnologieal  predietion  are  preseient.  This  work  does 
not  portend  to  be  as  masterful  as  Douhet’s,  nor  will  it  be  as  zealous.  It 
will,  however,  undertake  a  similar  ehallenge  by  attempting  to  bring  to  life 
the  ethieal  eonsiderations  of  eyber  warfare  before  this  diseipline  has 
matured  fully. 

The  Korean  Armistice:  Cyber  Warfare  and  a  Modern  Standoff 

It  is  the  year  2015  and  tension  eontinues  to  build  on  the  Korean 
peninsula.  In  the  north,  the  Democratie  People’s  Republie  of  Korea 
(DPRK)  eontinues  to  strengthen  its  nuelear  weapons  program  and  rattle 
the  sabres  of  war.  The  rhetorie  and  aggressive  aetions  of  the  DPRK  leave 
the  southern  Republie  of  Korea  (ROK)  and  many  of  its  international 
partners  feeling  inereasingly  threatened  and  vulnerable.^  Conventional 
forees  and  missile  systems  are  amassed  on  both  sides  of  the  38th 
parallel  while  international  politieal  and  diplomatie  powers  attempt  to 
eontrol  the  potential  erisis. 

The  DPRK’s  Supreme  Leader,  Kim  Jong-un,  eelebrating  his 
eountry’s  inereasing  military  prowess,  announeed  that  he  will  proeeed 
with  another  nuelear  weapons  test  to  demonstrate  his  eountry’s 
expanding  global  influenee.  Fears  swirl  that  this  test  eould  eombine  the 
DPRK’s  modernized  medium  range  ballistie  missile  program  with  its 

^  Douhet,  The  Command  of  the  Air,  294. 

^  Paul  B.  Stares,  "Military  Escalation  in  Korea,"  Council  on  Foreign  Relations,  Center  for  Preventive  Action, 
2010, 1,  http://i.cfr.org/content/publications/attachments/CPA_contingencymemo_10.pdf. 
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miniaturized  nuclear  warheads  in  North  Korea’s  first-ever  nuclear  launch 
beyond  the  confines  of  its  own  borders. ^  Japanese  and  American  Aegis 
cruisers  are  positioned  to  shoot  down  any  missiles  that  threaten  South 
Korea,  Japan,  or  any  other  nations  within  range  of  the  anticipated 
missile  test.^  Additionally,  other  more  creative  steps  have  been  taken 
behind  the  scenes  to  hedge  against  a  successful  missile  launch. 

Unbeknownst  to  the  North  Korean  government,  portions  of  their 
medium  range  missile  launch  and  tracking  system  have  been 
compromised  clandestinely  through  the  use  of  a  sophisticated  malware 
program.  The  program,  code  named  Operation  PANDORA,  is  able  to 
interrupt  the  missile  firing  sequence  in  a  handful  of  ways  that  appear  to 
be  normal  mechanical  failures.^  The  code  was  inserted  remotely  and  is 
awaiting  further  commands  from  its  creators.  The  main  objective  of 
Operation  PANDORA  is  to  undermine  the  confidence  DPRK  military 
operators  and  decision-makers  place  in  the  missile  systems  so  that  they 
choose  to  delay  further  tests  —  especially  tests  with  live  nuclear 
munitions. 

The  creators  of  the  code  used  in  Operation  PANDORA  have  not 
been  disclosed,  but  secondary  indicators  suggest  the  source  code  was 
emplaced  in  a  joint  venture  between  South  Korea  and  a  trusted  partner. 
The  operators  who  installed  the  malware  spared  no  expense  to  ensure 
anonymity  for  all  parties  involved.  If  successful,  this  effort  will  stall 
several  potential  missile  tests  on  the  launch  pad  before  they  are  able  to 
stir  international  fervor,  elicit  escalatory  responses  from  threatened 

"Fact  Sheet:  North  Korea's  Nuclear  and  Ballistic  Missile  Programs,"  Center  for  Arms  Control,  accessed 
April  14,  2014, 

http://armscontrolcenter.org/publications/factsheets/fact_sheet_north_korea_nuclear_and_missile_pro 
grams/.  It  is  conceivable  that  North  Korea  will  overcome  technological  hurdles  that  currently  prevent  it 
from  marrying  its  missile  and  nuclear  weapon  programs. 

^  Angela  Erika  Kubo,  Jake  Adelstein,  "Japan  Prepares  to  Shoot  North  Korean  Missiles  Out  of  the  Sky,"  The 
Daily  Beast,  April  10,  2014,  http://www.thedailybeast.eom/articles/2014/04/10/japan-prepares-to-shoot- 
north-korean-missiles-out-of-the-sky.html. 

®  "S.  Korea  Seeks  Cyber  Weapons  to  Target  North  Korea's  Nukes,"  The  Diplomat,  accessed  April  14,  2014, 
http://thediplomat.eom/2014/02/s-korea-seeks-cyber-weapons-to-target-north-koreas-nukes/. 
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nations,  or  cause  unintended  eatastrophe  should  a  dangerous  missile  fly 
off  eourse. 

Simultaneous  to  the  inereased  rhetorie  regarding  nuelear  systems, 
the  North  Korean  government  has  expanded  its  foray  into  the  realm  of 
eyber  warfare.  After  launehing  a  series  of  attaeks  against  South  Korea  in 
2013,  the  DPRK  has  added  thousands  of  “eyber-warriors”  to  its  eyber 
operations  units.  Presumably,  these  units  now  have  more  advaneed 
options  eapable  of  paralyzing  finaneial  systems,  utility  serviees  ineluding 
water  and  eleetrieal  supplies,  and  eommand  and  eontrol  systems  within 
various  targeted  eountries.'^  This  development  eomplieates  Operation 
PANDORA  beeause  it  offers  North  Korea  heightened  eyber  expertise  and 
more  in-kind  responses  should  the  DPRK  diseover  the  malware  operating 
on  their  systems. 

Operation  PANDORA  appears  on  the  surfaee  to  be  an 
extraordinarily  attraetive  option  for  poliey  makers  who  wish  to  limit 
North  Korean  antagonism  while  extending  the  timeline  for  more  peaeeful 
options  to  sueeeed.  This  operation  falls  below  the  internationally 
aeeepted  threshold  of  a  cyber- attack  beeause  it  does  not  eause  physieal 
damage  to  the  systems  it  targets.^  Furthermore,  the  operation  is 
designed  to  mimie  meehanieal  malfunetions  so  that  it  does  not  resemble 
an  esealatory  move  at  all.  While  North  Korean  motives  may  remain 
unehanged  as  Operation  PANDORA  unfolds,  this  non-lethal,  relatively 
unobtrusive,  eomputer  eode  may  help  de-esealate  the  impending  erisis. 
The  eyber  operation  is  highly  preeise,  ereating  almost  no  eollateral 
damage  in  its  wake.  This  level  of  diserimination  also  ereates  unmatehed 
proportionality  when  measured  against  other  options  that  stand  a 
reasonable  ehanee  of  sueeess. 


"North  Korean  Cyber-Rattling,"  The  Economist,  May  17,  2013, 
http://www.economist.com/blogs/babbage/2013/05/digital-warfare. 
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The  arguments  artieulated  in  the  preeeding  ehapters  of  this  paper, 
however,  should  prompt  a  eloser  examination  of  Operation  PANDORA 
before  one  is  swayed  to  offer  endorsement.  In  partieular,  three  key 
assumptions  Operation  PANDORA  takes  for  granted  warrant  a  more 
detailed  look.  First,  one  should  eonsider  whether  the  eode  used  in 
Operation  PANDORA  will  behave  as  expeeted.  Unintended  side-effeets 
eould  undermine  the  foundation  of  preeision  and  proportionality  that 
make  this  option  so  attraetive  in  the  first  plaee.  Next,  one  should  look 
past  intended  effeets  and  pereeived  anonymity  to  determine  if  the 
existing  threat  warrants  a  preventative  or  preemptive  aet.  What  one 
party  pereeives  to  be  a  desperate  preemptive  move  may  be  interpreted 
elsewhere  as  unjustified  aggression.  Finally,  one  should  eonsider  how 
this  type  of  subversive  aet  shapes  internationally-aeeepted  norms  in 
eyberspaee. 

If  reeent  examples  from  2012  to  2014  offer  any  indieation,  the  eode 
used  in  Operation  PANDORA  may  potentially  spread.  The  Stuxnet 
program,  for  instanee,  spread  rapidly  when  it  was  unintentionally 
transferred  outside  its  target  network.^  The  Shamoon  virus,  a  politieally 
motivated  attaek  against  the  Arameo  refinery  in  Saudi  Arabia,  erased 
data  on  more  than  30,000  eomputers.  The  virus  also  spread  to  refineries 
in  other  eountries  through  methods  the  attaek’s  originators  never 
expeeted.^®  These  preeedents  demonstrate  how  diffieult  it  is  to  test 
sophistieated  malware  against  eonditions  the  program  will  eneounter  in 
the  live  environment  of  eyberspaee.  Even  when  maehines  aet  in  highly 
predietable  ways,  humans  interaeting  with  maehines  may  spread  eode 
from  Operation  PANDORA  in  ways  that  eause  further  instability  or  harm. 
The  ereators  eannot  prediet  eonfidently  the  effeet  Operation  PANDORA 


^  McDonald  et  at,  "Stuxnet  0.5." 

Christopher  Bronk  and  Eneken  Tikk-Ringas,  "Hack  or  Attack?  Shamoon  and  the  Evolution  of  Cyber 
Conflict,"  Survival,  Global  Politics  and  Strategy,  no.  March  2013  (February  1,  2013):  3, 
http://bakerinstitute.org/files/641/. 


68 


will  have  on  non-combatants  or  the  medium  of  cyberspace  itself  if  the 
code  propagates  in  unintended  ways. 

Even  if  Operation  PANDORA  achieves  its  desired  effects  with  the 
level  of  precision  its  creators  anticipate,  political  leaders  must  objectively 
decide  whether  the  existing  threat  warrants  this  type  of  aggressive 
action.  Walzer  reminds  us  that  the  burden  of  proof  in  any  preemptive  or 
preventative  engagement  rests  with  the  aggressive  actor.  ^  ^  The  proctors 
of  Operation  PANDORA  must  consider  whether  an  incursion  into 
sovereign  North  Korean  territory,  whether  physical  or  virtual,  is  justified 
given  the  fact  that  the  DPRK  publicized  its  upcoming  launch  as  a  test.  A 
non-lethal  invasion  of  sovereignty  is  an  invasion  nonetheless. 

While  Operation  PANDORA  is  designed  to  help  deescalate  the 
existing  crisis,  the  planners  responsible  for  this  event  must  appreciate 
the  lack  of  international  treaties,  laws,  and  norms  governing  this  type  of 
activity.  The  operation  is  designed  to  be  non-lethal  and  non-destructive. 
If  the  North  Korean  government  interprets  this  incursion  as  an  act  of 
war,  however,  they  are  likely  to  respond  in  an  escalatory  fashion  absent 
any  available  pattern  or  precedent.  Predicting  a  rational  response  when 
no  standard  or  norm  exists  is  nearly  irrational  in  itself.  Schelling 
reminds  us  that  when  states  act  rationally,  their  actions  are  “based  on 
an  explicit  and  internally  consistent  value  system. cyberspace  and 
cyber  warfare,  the  value  system  remains  flush  with  ambiguity. 

What  might  potential  retaliatory  actions  look  like?  The  DPRK  may 
retaliate  in-kind,  launching  cyber  operations  against  South  Korean 
financial  and  broadcast  systems  similar  to  those  observed  in  2013.^3 
North  Korea  might  increase  tensions  along  the  demilitarized  zone  by 
repositioning  forces  and  removing  diplomatic  safeguards.  The  north 
might  unleash  additional  provocative  artillery  attacks  against  the 

Walzer,  Just  and  Unjust  Wars,  76-82. 

Schelling,  The  Strategy  of  Conflict,  4. 

"North  Korean  Cyber-Rattling." 
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disputed  island  of  Yeonpyeong  as  they  did  several  times  between  2010 
and  2014.1"^  All  of  these  aetions  are  esealatory,  and  should  be 
eonsidered  as  probable  responses  to  Operation  PANDORA’S  de-esealatory 
objeetives. 

The  final  issue  that  should  be  entertained  before  Operation 
PANDORA  is  permitted  is  whether  the  ethieal  criteria  for  last  resort  have 
been  considered.  The  relatively  low  probability  of  significant  casualties 
or  damage  may  prompt  decision-makers  to  undertake  this  operation 
before  feasible  alternatives  are  exhausted.  This  is  especially  true  given 
the  maniacal  reputation  the  DPRK  government  possesses  in  international 
relations.  Alternatively,  leaders  may  decide  Operation  PANDORA  nests 
neatly  with  the  last  resort  criteria  because  it  is  the  best  option  available 
that  prioritizes  prima-facie  requirements  while  still  retaining  a  reasonable 
chance  of  success. 

The  discussion  above  is  intentionally  non-definitive.  None  of  the 
opinions  or  considerations  presented  here  provide  a  clear-cut  verdict  on 
the  ethical  legitimacy  of  Operation  PANDORA.  Answers  in  2015, 
however,  will  be  more  reachable  than  they  were  in  2013  because  of  the 
norms  and  precedents  established  over  time.  The  point  is  not  to  reach  a 
conclusion  that  satisfies  existing  measures  of  ethical  legitimacy  because 
there  are  none.  The  aim,  in  this  case,  should  be  to  strive  toward  a 
contemplative,  considerate  discussion  on  ethics  so  that  the  norms  our 
actions  produce  move  beyond  asking  what  can  be  done  toward  informed 
decisions  regarding  what  should  be  done. 


"North  Korea,  South  Korea  Exchange  Fire  Near  Disputed  Sea  Border;  Hundreds  Of  Artillery  Rounds 
Fired,"  Huffington  Post,  March  31,  2014,  http://www.huffingtonpost.eom/2014/03/31/north-korea- 
south-korea-exchange-fire_n_5061436.html. 

Stares,  "Military  Escalation  in  Korea,"  3. 
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Chapter  5 
Conclusion 


Why  does  man  set  out  to  define  the  ethies  of  warfare?  If  peaee  may 
be  foreed  through  domination,  why  do  we  expend  sueh  tremendous  effort 
defining  self-imposed  hindranees  that  limit  how  and  when  we  fight?  This 
work  suggests  the  answer  is  twofold.  First,  wars  are  not  simply  fought  to 
bring  about  peaee;  they  are  fought  to  establish  a  better  peace  than  that 
whieh  existed  prior  to  the  start  of  hostilities.  ^  War  exaets  enormous 
eosts.  If  the  lives,  treasure,  and  prestige  one  expends  in  war  leave 
anything  less  than  a  better  peaee,  hostilities  are  more  likely  paused  than 
resolved.  There  should  be  room  in  any  eonfliet  for  one  party  to  aeeept 
defeat.  If  this  is  to  oeeur,  however,  wars  must  be  fought  in  ways  that 
resolve  hostilities  without  ereating  enduring  hatred.  Ethies  help 
strategists  and  politieal  deeision-makers  determine  when  and  how  to 
fight  in  order  to  leave  better  peaee  in  war’s  wake. 

A  seeond,  equally  important  eonsideration  is  the  notion  that 
aetions  in  warfare  define  norms.  While  better  peaee  is  the  ultimate 
objeet  of  war,  realistie  praetitioners  understand  that  war  is  an  enduring 
enterprise.  A  war  fought  ethieally  ereates  a  legaey  of  norms  that  shape 
future  hostilities.  Combatants  do  not  eonform  to  the  Law  of  Armed 
Confiiet  solely  beeause  of  altruistie  beliefs  about  human  treatment,  for 
instanee.  This  widely  aeeepted  norm  exists  so  that  eombatants  might 
reasonably  expeet  humane  treatment  should  they,  themselves,  fall 
wounded  or  ill  on  the  battlefield.  The  penultimate  ease  of  the  golden 
rule,  ethies  in  war  ask  eombatants  to  do  unto  others  only  that  whieh 
they  ean  tolerate  themselves. 

Sometimes,  war  is  inevitable.  Aggression,  left  uneheeked  brings 
war  to  unwitting  parties.  In  other  times,  overwhelming  forees  ereate 


^  Liddell  Hart,  Strategy,  338. 
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conditions  that  threaten  entire  eivilizations,  eausing  ethies  and  justiee  to 
fall  behind  survival.  In  these  instanees,  where  one  faees  formidable 
odds,  ereativity  should  trump  blind  attempts  at  lethality.  A  lone, 
exhausted  soldier  in  an  open  field,  for  instanee,  should  earefully  eonsider 
his  entire  range  of  options  before  he  eharges  a  well-armed  foe.  Violenee 
imbued  with  little  ehanee  of  sueeess  is  nearly  equitable  to  surrender. 
While  the  most  ethieally  permissible  form  any  war  ean  take  is  one 
proseeuted  for  self-defense,  responsible  deeision-makers  will  also  look 
beyond  the  traditional  bounds  of  war  for  other,  more  praetieable  ways  to 
aehieve  desired  effeets. 

On  this  premise  one  finds  the  promise  of  war  in  and  through 
eyberspaee.  Cyber  warfare  offers  tantalizing  possibilities  that  might 
reshape  JUS  ad  bellum  and  jus  en  bello  eonsiderations  in  future  wars. 
Through  preeision,  diserimination,  and  the  ability  to  produee  effeets 
without  the  normal  trapping  of  lethality  found  in  other  domains,  eyber 
warfare  may  expand  the  pool  of  options  available  to  strategists  striving  to 
resolve  hostilities.  As  more  faeets  of  warfare  beeome  dependent  upon 
eyberspaee,  more  threats  may  be  negated  rather  than  killed  or  destroyed. 
These  promising  eapabilities,  however,  may  tempt  politieal  and  military 
leaders  into  beeoming  enamored  with  eyber  warfare  as  a  less  risky,  more 
aeeeptable  form  of  warfare.  Ineursion  in  the  logieal  domain /eeZs  less 
poignant  than  invasions  of  sovereignty  eondueted  by  land,  sea,  and  air 
forees,  for  example.  Yet  as  eyberspaee  and  the  eapabilities  it  faeilitates 
mature,  strategists  should  temper  what  can  be  done  with  thoughtful 
eonsideration  of  what  should  be  done  to  establish  tolerable  norms  and 
better  peaee. 

eyberspaee  is  a  unique  domain  that  faeilitates  altogether  different 
interpretations  of  time,  spaee,  geography,  power,  eulture,  and  strength. 
The  distinetive  eharaeteristies  of  eyberspaee  offer  tremendous  benefits  to 
the  world  in  terms  of  eeonomie  opportunity,  information  sharing,  and 
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cultural  homogeneity.  The  same  eharaeteristies  of  the  domain  that 
reshape  opportunities,  however,  reshape  our  thinking  about  war.  When 
eompared  with  traditional  forms  of  warfare,  eyber  warfare  offers  ways  in 
whieh  prima-facie  obligations  ean  still  take  preeedenee  while  aetively 
seeking  military  objeetives.  Strong  evidenee  suggests  the  offense  wields 
signifieant  advantages  over  the  defense  in  eyber  warfare,  offering 
opportunities  to  shape  the  strategie  environment  by  quelling  emerging 
threats  preemptively. ^  Additionally,  eyberspaee  offers  tremendous 
safeguards  of  anonymity  and  non-attribution  that  ean  be  exploited  to 
produee  effeets  with  little  fear  of  retribution. ^  Yet  at  the  same  time, 
weapons  of  eyber  warfare  are  diffieult  to  test  outside  the  realistie 
environment  only  available  in  the  aetive  domain  of  eyberspaee.^  This 
makes  eyber  warfare  a  gamble  where  losses  involve  violations  of  the 
proportionality,  non-eombatant  immunity,  and  good  faith  imperatives. 

Eaeh  time  this  gamble  is  undertaken,  however,  eyber  warfare 
norms  further  erystalize  around  aeeeptable  and  unaeeeptable  limits. 
Nations  that  undertake  preemptive  aetion  in  eyberspaee  must 
understand  their  own  vulnerability  to  these  same  types  of  aetivities. 
Nations  that  ehoose  to  operate  under  the  eloak  of  anonymity  must 
understand  their  aetions  serve  as  votes  in  favor  of  legitimizing  this 
behavior.  Those  who  are  most  dependent  upon  the  eapabilities  of 
eyberspaee  are  also  the  most  vulnerable  to  the  erippling  effeets  of  eyber 
warfare.  With  few  viable  teehnieal  solutions  available  to  eounter  the 
threat  as  it  presents  itself,  norms  of  behavior  beeome  inereasingly 
important  in  shaping  the  strategie  environment.  The  short-term  benefits 
of  elandestine  aetivity  in  eyberspaee  may  very  well  be  usurped  by  the 
formative  advantages  that  ean  be  produeed  when  nations  aet  responsibly 
in  this  emerging  domain. 

^  Williams,  "Ten  Propositions  Regarding  Cyberspace  Operations,"  10-17. 

^  R.  Nicholas  Burns  et  at,  eds..  Securing  Cyberspace:  A  New  Domain  for  Nationai  Security  (Washington, 
D.C.:  Aspen  Institute,  2012),  49-51. 

''  Barrett,  "WARFARE  IN  A  NEW  DOMAIN,"  10. 
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This  work  has  been  intentionally  vague  in  terms  of  ethieal 
judgment.  A  quandary  has  emerged  that  limits  the  viability  of  verdiets 
issued  at  this  point  in  the  development  of  this  fast-evolving  field.  Norms 
drive  aeeeptability  but  norms  are  formed  by  reactions.  Minimally- 
aeeeptable  behavior  will  not  beeome  evident  until  it  is  so  judged.^  Lines 
drawn  in  shifting  sands  are  both  fleeting  and  arbitrary.  At  best, 
judgments  issued  here  might  happen  to  align  with  norms  that  form  later. 
At  worst,  they  will  unneeessarily  limit  the  potential  positive  uses  for  this 
new  form  of  warfare. 

An  absenee  of  verdiets,  however,  should  not  detraet  from  the  main 
purpose  of  this  work.  The  goal  has  never  been  to  develop  guidelines,  but 
rather,  this  work  attempts  to  elieit  eareful  thought  and  planning  in  plaee 
of  haphazard  exeeution.  This  paper  is  not  about  answers  as  mueh  as  it 
is  about  reeognizing  the  existenee  of  new  questions.  As  warfare  moves 
further  into  the  eyberspaee  domain,  uneomfortable  dilemmas  emerge 
ineluding: 

•  Is  it  ethieal  to  target  non-eombatants  in  eyberspaee  with 
eoereive,  but  non-lethal  methods  in  order  to  aehieve  objeetives 
that  would  otherwise  only  be  aehievable  through  the  use  of 
foree? 

•  Does  eyber  warfare’s  exaetingly  preeise,  non-lethal  eharaeter 
lower  the  thresholds  for  permissible  intervention  if  doing  so  ean 
derail  potentially  eatastrophie  aetivities? 

•  Are  the  immediate  benefits  of  hiding  behind  anonymity  in 
eyberspaee  worth  their  eorresponding  eosts  in  terms  of 
legitimaey  for  the  field  of  eyber  warfare  as  a  whole? 

•  Should  the  eommonly-aeeepted  western  definition  of  war,  where 
violenee  plays  an  integral  role,  be  reinterpreted  given  the  new, 
more  flexible  options  eyber  warfare  ereates? 

^  Dr.  George  R.  Lucas,  Jr.  on  Just  War  and  Cyber  Conflict  Part  2. 
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This  list  is  not  all-inclusive,  nor  is  it  rigid.  These  questions  will 
inevitably  be  reeast,  resolved,  and  possibly  even  disregarded  as  norms  in 
this  field  give  rise  to  more  intrieate  eonsiderations.  Yet  these  questions, 
along  with  the  rest  of  the  inquiries  posed  throughout  this  work,  are 
important  beeause  they  direetly  influenee  the  eharaeter  of  war.  Cyber 
warfare  offers  praetitioners  and  strategie  deeision-makers  more  options 
geared  to  aehieve  battlefield  effeets  that  may  not  require  loss  of  life  or 
eatastrophie  damage.  Warfare  will  oeeur  in  eyberspaee.  May  it  be 
guided  by  those  willing  to  aeeept  the  intelleetual  ehallenges  and  superb 
ethieal  responsibilities  this  great  souree  of  power  deserves.  When  ethieal 
eonsiderations  remain  paramount,  wars  help  bring  forth  better  peaee.  If 
similarly  high  standards  are  adopted  in  the  eyber  domain,  eyber  warfare 
helps  bring  forth  better  war. 
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